Applied Algebra: Codes, Ciphers and Discrete Algorithms, Second Edition (Discrete Mathematics and Its Applications)

Citation preview

DISCRETE MATHEMATICS AND ITS APPLICATIONS Series Editor KENNETH H. ROSEN

APPLIED ALGEBRA CODES, CIPHERS, AND DISCRETE ALGORITHMS SECOND EDITION

DAREL W. HARDY COLOR ADO STATE UNIVERSITY FORT COLLINS, U.S.A.

FRED RICHMAN fLORIDA ATLANTIC UNIVERSITY BOCA RATON, U

SA

CAROL L. WALK.ER NEW MEXICO STATE UNIVERSITY LAS CRUCES, U SA

�CRC Press �

Taylor&. Francis Group Boca Raton

London

New York

CRC Press is an Imprint of the Taylor & Francis Group, an lnforma business

A CHAPMAN & HALL BOOK

Chapman & Hall/CRC Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2009 by Taylor & Francis Group, LLC Chapman & Hall/CRC is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S. Government works Printed in the United States of America on acid-free paper 10 9 8 7 6 5 4 3 2 1 International Standard Book Number-13: 978-1-4200-7142-9 (Hardcover) This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to publish reliable data and information, but the author and publisher can­ not assume responsibility for the validity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers. For permission to photocopy or use material electronically from this work, please access www.copy­ right.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that pro­ vides licenses and registration for a variety of users. For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged. Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe. Library of Congress Cataloging-in-Publication Data

�

Hardy, Da. � WJ;. �rn:-,,. \ Applie.!i'!l:f��bra :,_c:odes;Ciphers, and di'screte algorithms I Dare! W. Hardy, Carol L. Wall(k - - '2'n€Hl'Q:; I Fred Richman. ·. p. �ffi'. �- (Discrete -�athematics, it�. applications) Includes bibliographical references and index. : ISBN 978q-4200-7142-9 (hardcover: alk. paper) 1. Coding theory. 2. Computer security--Mathematics. I. Walker, Carol L. II. Richman, Fred. III. Title. IV. Series; QA268.H365 2009 003'.54--dc22 Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the CRC Press Web site at http://www.crcpress.com

2009000533

Contents Preface 1 Integers and Computer Algebra

1.1 1.2 1.3 1.4

Integers . . . . . . . . . . . . . . . . . . . . Computer Algebra vs. Numerical Analysis . Sums and Products . . . Mathematical Induction

1

1 4 6 8

2 Codes

15

3 Euclidean Algorithm

39

4 Ciphers

61

2.1 2.2 2.3 2.4 2.5 2.6

3.1 3.2 3.3 3.4 3.5

4.1 4.2 4.3 4.4 4.5 4.6 4. 7

Binary and Hexadecimal Codes ASCII Code . Morse Code . . . . . . Braille . . . . . . . . . Two-out-of-Five Code Hollerith Codes The Mod Function . . . . . . . Greatest Common Divisors . . Extended Euclidean Algorithm The Fundamental Theorem of Arithmetic Modular Arithmetic

Cryptography . . . . . . . . . . . . . . Cryptanalysis . . . . . . . . . . . . . . Substitution and Permutation Ciphers Block Ciphers . . . . The Playfair Cipher Unbreakable Ciphers Enigma Machine

5 Error-Control Codes

5.1 Weights and Hamming Distance . . . . . . 5.2 Bar Codes Based on Two-out-of-Five Code

15 22 24 27 32 34

39 42 47 52 55

61 68 75 82 88 92 95

101

101 106

5.3 Other Commercial Codes 5.4 Hamming ( 7, 4 ) Code . .

112 120

6 Chinese Remainder Theorem

6.1 6.2 6.3 6.4 6.5

Systems of Linear Equations Modulo Chinese Remainder Theorem . . . . . . Extended Precision Arithmetic . . . . . Greatest Common Divisor of Polynomials Hilbert Matrix . . . . . . . . . . . . . . . n .

7 Theorems of Fermat and Euler

7.1 7.2 7.3 7.4 7.5 7.6

Wilson's Theorem . . . . Powers Modulo . Fermat's Little Theorem . . . . Rabin's Probabilistic Primality Test Exponential Ciphers Euler ' s Theorem n

.

.

.

.

.

.

.

8 Public Key Ciphers

8.1 8.2 8.3 8.4 8.5

The Rivest-Shamir-Adleman Cipher System Electronic Signatures . . . . . . . . . A System for Exchanging Messages . Knapsack Ciphers . . . . . Digital Signature Standard

9 Finite Fields

9.1 9.2 9.3 9.4 9.5 9.6 9.7

The Galois Field GFp . . . . . . The Ring GFp[x] of Polynomials The Galois Field GF4 . . . . . . The Galois Fields GFs and GF16 The Galois Field GFpn . . . . . . The Multiplicative Group of GFpn Random Number Generators

10 Error-Correcting Codes

10. 1 BCH Codes . . . . . . 10.2 A BCH Decoder . . . 10.3 Reed-Solomon Codes .

11 Advanced Encryption Standard

11.1 Data Encryption Standard . 11.2 The Galois Field GF256 . . 11.3 The Rijndael Block Cipher

127

127 132 137 141 147

153

153 155 158 163 168 171

177

177 183 185 190 194

199

199 204 212 217 225 229 235

241

242 249 258

261

262 265 270

12 Polynomial Algorithms and Fast Fourier Transforms

277

Appendix A Topics in Algebra and Number Theory

307

Solutions to Odd Problems

317

Bibliography

395

Notation

397

Algorithms

399

Figures

401

Tables

403

Index

405

12.1 12.2 12.3 12.4 12.5 12.6

A.1 A.2 A.3 A.4 A.5

Lagrange Interpolation Formula . . . . . . Kronecker's Algorithm . . . . . . . . . . . Neville's Iterated Interpolation Algorithm Secure Multiparty Protocols . Discrete Fourier Transforms Fast Fourier Interpolation . .

Number Theory . . . . . Groups . . . . . . . . . . Rings and Polynomials . Fields . . . . . . . . . . Linear Algebra and Matrices

277 282 285 290 292 301

307 308 310 311 312

Preface Applied Algebra: Codes, Ciphers, and Discrete Algorithms, Second Edition

deals with the mathematics of data communication and storage. It includes hints for using Scientific Notebook® , Maple® , or MuPAD® to do complicated calculations and to make the mathematical ideas more accessible. Two central topics are data security (how to make data visible only to friendly eyes) and data integrity (how to minimize data corruption) . Cryptography is the study of data security: How can a bank be sure that a message to transfer $1 ,000,000 was sent by an authorized person? Or imagine a political crisis in a remote region of the world. It is vital that sensitive issues be discussed with government leaders back home. The crisis could get out of control if these discussions were intercepted and read by some third party. The messages are bounced off of satellites so the signals can be captured by anyone with a simple satellite dish . . How can the messages be transformed so that a third party cannot read them, yet they can easily be read by friends back home? Issues of data integrity are handled by error-control codes. The first pictures transmitted from the back side of the Moon in the late 1960s were in black and white, and of poor quality. Lost data caused vertical black streaks in the pictures. The loss of data was due to interference from solar radiation. More recent pictures from much greater distances using the Voyager series of planetary probes were beautiful, high-resolution color images with no apparent lost data. This was mostly the result of software that detects and corrects errors caused by interference. This book discusses mathematically interesting methods for solving these problems-methods that are practical and widely used. The material was de­ signed for a course in applied algebra for juniors and seniors majoring in math­ ematics and computer science. The primary mathematical tools come from number theory and the theory of finite fields. All mathematics that will be used is developed as needed, but students who have had a prior course in abstract algebra or linear algebra have found such background to be useful. Supercomputers perform billions of operations per second, and must store and retrieve vast amounts of data. The probability of a single read/write error is small, but doing billions of read/writes can make the probability of at least

one error relatively large. Many computer codes (such as those required to do modern cryptography) will not tolerate even a single error. These fast computers must be designed so that errors-even multiple errors-can be recognized and corrected before causing trouble. These examples reflect advances in hardware, but mostly advances in math­ ematics. Desktop computers can detect single errors and larger computers can correct multiple errors. The error-correction capabilities of the Voyager project resulted in thousands of flawless pictures being sent back to Earth to be ana­ lyzed. Improvements in computer hardware since the 1950s have been incredible. In pushing technology to its limits, we are restricted by the physical size of atomic particles and the speed of light. Scientists are now considering the use of clean rooms in orbit to eliminate the few stray particles that contaminate Earth-bound labs. In spite of these dramatic changes, the increase in speed due to improve­ ments in mathematical algorithms has been even more spectacular. For many problems, the net effect since 1950 on computing speed due to improved algo­ rithms has been greater than that due to improved hardware. (We will see an example of a problem in cryptography that would take more than 10 10 years on the fastest theoretical computer that we could imagine using naive methods, but is computable in a few nanoseconds on a PC using more sophisticated algo­ rithms.) This trend is likely to continue, because mathematics itself recognizes no physical bounds. We will look at several algorithms that arise in the study of cryptography and error-control codes. Many of these algorithms feature common-sense approaches to relatively simple problems such as computing large powers. Other algorithms are based on interesting mathematical ideas. Those who become hooked on applied algebra will eventually need to learn abstract algebra, and lots of it. This book attempts to show the power of algebra in a relatively simple setting. Instead of a general study of finite groups, we consider only finite groups of permutations. Just enough of the theory of finite fields is developed to allow us to construct the fields used for error-control codes and for the new Advanced Encryption Standard. Almost everything we do will be with integers, or polynomials over the integers, or remainders modulo an integer or a polynomial. Once in a while we look at rational numbers. A floating-point number is different from a rational number or a real number. Each floating-point number corresponds to infinitely many rational numbers (and to infinitely many irrational numbers) . Computer algebra systems such as Maple or MuPAD deal primarily with integers and rational numbers-not floating-point numbers. Numerical analysis packages such as MATLAB® and IMSL use floating­ point arithmetic . They trade precision for speed. Computer algebra systems are generally much slower than numerical analysis routines using floating-point arithmetic. When high precision is important-and it is essential for many problems in algebra-we have to go with computer algebra systems.

Interactive Version Using Scientific Notebook® This book includes an interactive version, on CD-Rom, of Applied Algebra: Codes, Ciphers, and Discrete Algorithms / Second Edition and the software Sci­ entific Notebook, a mathematical word processor and easy-to-use computer al­ gebra system. This software is used as the browser for reading the interactive version of the book, and provides the text editor and computing engine for interactive examples and self-tests. The interactive version contains all of the material from the print version. In addition, the interactive version •

Adds links that make it easy to find topics and navigate page-by-page, chapter-by-chapter, or by keywords

•

Adds interactive examples

•

Adds computing hints

•

Adds self tests

We believe you will find it convenient to have the interactive version of Ap­ plied Algebra: Codes, Ciphers, and Discrete Algorithms, Second Edition and the software Scientific Notebook installed on your computer. After your license for Scientific Notebook expires, you can still use it as a browser for reading the book. Only the interactive features-such as the interactive examples and self tests-will be lost. Computing hints are provided for using Scientific Notebook, Maple, and MuPAD in order to understand better the ideas developed in this book. By now, all of us tend to use a calculator for routine numerical calculations-even for balancing a checkbook. Want to compute 2::o ri ? Need, to find 543! + 2 100 ? How about the first 37 terms of the Taylor series for f (x ) x sin x expanded about x /4? These are all child's play using Scientific Notebook ( an interface to MuPAD) or using a computer algebra system such as Maple or MuPAD directly. With these systems you can concentrate on the mathematics and not be distracted by the computations. Computer algebra packages (Axiom, Derive, MuPAD, Maple, Mathematica, Reduce, etc. ) are becoming tools of the trade. In the future you might well need to know how to use such a package. You may even have such a package already installed on your own personal computer. These packages have many limitations, and it is important that you have a good idea of what they will and will not do. By reading this book and experimenting with the computer algebra hints, you should acquire a good feel for the capabilities and limitations of these packages. You will find this software useful for your other courses as well. Entering text and mathematics in Scientific Notebook is so straightforward there is practically no learning curve. And, with the built-in computer algebra system, you can use =

= 1r

the intuitive interface to solve equations right in your documents without having to master a complex syntax. With Scientific Notebook, you can compute symbolically or numerically, in­ tegrate, differentiate, and solve algebraic and differential equations. You can also create 2D and 3D plots in many styles and coordinate systems, and ani­ mate the plots. Scientific Notebook provides a ready laboratory in which you can experiment with mathematics to develop new insights and solve interesting problems, as well as a vehicle for producing clear, well-written homework.

Acknowledgments Our thanks go to the students who enrolled in the course Information Integrity and Security at Colorado State University. Their questions and insights led to many improvements in the original manuscript. They also wrote much of the computer code that appears on the websites. We would also like to thank our acquiring editor Bob Stern, who convinced us to sign with CRC /Taylor Francis and gave us several helpful suggestions, and our production coordinator Marsha Pronin, editorial assistant Samantha K. White, cover designer Kevin Craig, and project editor Michele A. Dimont, who skillfully led us through the task of converting our manuscript into a printed text. We thank Shashi Kumar of International Typesetting and Composition for solving technical problems with the manuscript, and David Walker, whose sharp eyes helped us create a clean manuscript. We thank the Scientific WorkPlace® team, whose product helps make technical writing fun, with special thanks to George Pearson, a TgXspert who assisted us with the final production of this manuscript. Darel W. Hardy Fort Collins, Colorado Fred Richman Boca Raton, Florida Carol L. Walker Las Cruces, New Mexico

Chapter 1

Integers and Computer Algebra Number theory is the study of the integers: . . . , -3, -2, - 1 , 0, 1, 2, 3, . . .. Num­ ber theorists investigate how the integers behave under addition and multipli­ cation. Often they deal with just the nonnegative integers, 0, 1, 2, 3, . . . , or with the positive integers 1, 2, 3, 4, . . .. The theory of numbers is especially entitled to a separate history on account of the great interest which has been taken in it continuously through the centuries from the time of Pythagoras, an interest shared on the one extreme by nearly every noted mathematician and on the other extreme by numerous amateurs attracted by no other part of mathematics .

Leonard Eugene Dickson

1.1

Integers

As simple as the integers may seem, many mathematicians have devoted their lives to studying them. Problems in number theory are often easy to state but difficult to solve. In the early 1600's, Pierre de Fermat said that if n is an integer greater than 2, then the equation xn + yn zn has no solution in positive integers x, y, and z. He gave no proof. Hundreds of mathematicians, both amateur and professional, tried to prove or disprove this statement. In 1995, some 350 years after Fermat made the claim, Andrew Wiles 1 of Princeton University gave =

1 You can find information about Wiles, Fermat, and other mathematicians from Mac Tutor History of Mathematics archive site at http:/ fwww-groups.dcs.st­ andrews.ac. uk;-history/. The

1

CHAPTER 1. INTEGERS AND COMPUTER ALGEBRA

2

a complicated proof in his paper, "Modular elliptic curves and Fermat's Last Theorem," in the Annals of Mathematics.

=

Definition 1 . 1 We say that an integern divides an integerm, and writenlm, if there is an integer a such that na m. We also say that m is a multiple of n or that n is a divisor of m . A n integer p > 1 is a prime if its only positive divisors are 1 and p. The first five primes are 2, 3, 5, 7, and 11. An integer n > 1 that is not a prime is called a composite. The first five composites are 4, 6, 8, 9, and 10 .

Don't confuse the symbol n l m, which means that n divides m, with the fraction n fm. This is especially easy to do when you write them by hand! Many problems in number theory deal with divisors and primes. Problem 1.2 Determine whether a given large number is prime or composite.

This turns out to be relatively easy to do. We will show how you can do this on a small computer for numbers with hundreds of digits. Problem 1.3 Find the prime divisors of a given composite number .

This seems to be hard. Oddly enough, we can recognize that a number is composite without being able to find any of its factors. Many of today's cryptographic systems rely for their security on this inability to factor large numbers. Here are a few elementary properties of divisors.

=

Theorem 1.4 Let a, b , c, x , and y be integers. i. If alb and bla , then a

±b .

ii. If alb and blc, then alc. iii. If cia and clb , then cl(ax +by) .

One problem in this section is to prove this theorem. ( See problem 6.) Problems 1 . 1

d2 s n. Show that 101 is prime by showing that 101 has no prime divisors d such

1. Show that ifn 2.

that 1





1?

19. Can n2 + 1 be a prime if n is odd? What if n is even?

CHAPTER 1. INTEGERS AND COMPUTER ALGEBRA

4

20. If 2n + 1 is prime, then must

n

be prime?

21. If 2 n - 1 is prime, then must n be prime? 22. If there are least four composites between two consecutive primes, then there are at least five composites between these two primes. Why?

1.2

Computer Algebra vs. Numerical Analysis

Numerical analysis includes the study of round-off and truncation errors when using floating-point arithmetic. A floating-point number is a number written in the foim ±m x 10e where m is a decimal to a fixed number of digits of a number between 1 and 10, and e is an integer in some fixed range. Examples are 4.683940958 X 1022 and

-2.435623410 X 10 - 1 7 .

Here we have used ten digit numbers for the number m, which is called the e might be something like -37 < e < 38 or -200 < e < 200. Addition and multiplication of floating-point numbers are very fast on computers that have special hardware, a floating-point accelerator, to do floating point operations. Sums and products of floating-point numbers are not exact because of the fixed number of digits in m. Every time you add or multiply, you introduce a small error. One goal of numerical analysis is to determine the accuracy of the final answer. mantissa. Ranges for

Example 1.5 In computing the product of 4.683940958x 10 22 and 7.948735673x

10 1 3 on a computer that supports a 10-digit mantissa , the exact answer is 3. 7231408583080394734 X 1036

but the mantissa would have to be rounded to ten digits , so that the result would be 3. 723140858 X 1036 Floating-point numbers cannot represent all integers and rational numbers exactly. The integer 12345678901 cannot be represented exactly by a floating­ point number with a ten-digit mantissa. The rational number i/3 cannot be represented exactly by any floating-point number. Computer-algebra systems represent integers and rationals exactly, and computer-algebra evaluations yield exact results:

1:2.

COMPUTER ALGEBRA VS; NUMERICAL ANALYSIS

5

738475937594759 X 5838593589383 4311660 875154360261498843697 =

2783479 75837594375 + 385793759 374853795738548

=

28 428 010 112 222 955 601 975 061 144 616 254 933 392 614 121 932

100! 93 326 215 443 944 152 681 699 238 856 266 700 490 715 968 264 381 621 468 592 963 895 217 599 993 229 915 608 941463 976 156 518 286 253 697 920 827 223 758 251 185 210 916 864 000 000 000 000 000 000 000 000 =

Some irrational numbers, like V2, are represented exactly in computer alge­ bra systems. A typical computer algebra system will compute ( V2) 2 as 2. Floating-point evaluations yield approximate results.

=

738475937594759 X 5838593589383 = 4. 311 660 875 X 1027 2783479 75837594375 385793759 + 374853795738548 196. 575 482 6 100! = 9. 332 621 544 X 10 1 57 Exact arithmetic is usually slower than floating-point arithmetic. Why do we need exact arithmetic? In the real world, we can rarely measure anything exactly. In fact, exact arithmetic with very large integers is used in ATM machines, credit card transactions, and in cryptography. We will see several examples of how large integer arithmetic can be used to make internet transactions secure. Problems 1 .2 1. The two numbers 3.14 and 22 / 7 both claim to be the best approximation to Which is the better approximation, and why? 1r.

2. List the numbers .JTI), and 3.16 in increasing order. Justify your answer. 3. Use a computer algebra system to find the floating-point representation 1r,

of with a ten-digit mantissa. 1r

4. Find at least two more numbers with the same floating-point representa­ tion as computed in Problem 3.

CHAPTER 1. INTEGERS AND COMPUTER ALGEBRA

6

Define xafb = �. Explain why � is not always the same as � · 6. Evaluate the following using floating-point arithmetic with a ten-digit mantissa.

5.

(a) l + � (b) 10 + 1 . 1

x

w- 10

7. Show that

1

3

= 0.333333333333 . . . = 0.3-

=

where the overbar indicates that 3 repeats forever. 8. Show that, 1 2 = 0.4999999999999 . . . 0.49 9. Rewrite the number x = 3.489 as a rational number. 10. Find an exact repeating decimal representation for 1/61. 11. The rational number aj b evaluates numerically to 0.469 387 755. If a and b are both two-digit integers, what are they?

1.3

Sums and Products

We have a compact notation for the sum of a list of numbers:

n i=l

L ai = a 1 + a 2 + · · · + an The letter i on the left-hand side of this equation is called an index. It could be replaced by any other symbol without changing the meaning of the sum:

n n = 2: ai L ai j= l i= l

Notation

1.6

(Summation) If n and

m

are integers such that

n ::; m,

then

m

L ai an + an+l + · · · + am

For example,

i= n

=

2 2: (5 + i) = (5- 3)+ ( 5 - 2)+ (5 - 1 ) + (5 - o) + (5 + 1) + (5 + 2) = 21 i= -3

and

4

2: e = 2 2 + 3 2 + 42

k= 2

=

29

1.3. SUMS AND PRODUCTS Theorem

1. 7

7

The following equations hold for the summation notation:

Proof. The first formula is the distributive law:

m L kai = kan + kan+ 1 + · · · + kam i=n m I

The other two formulas are left as problems. There is a compact notation for products just like for sums. Notation 1.8 (Product)

Example 1.9

=

Ifn and m are integers such thatn::; m, then

m IT ai = an an+1 . . . am i=n

TI�� 1 j2 13 168 189 440 ooo

f1�=1 j = 24 TI�� 1 k 3628 8oo

=

10! = 3628 800

Problems 1 . 3

Use a calculator or computer algebra system to evaluate the sums and products in Problems 1- 10. Justify as many as possible by hand.

10 1. .L:2 j=1 10 10 3. .L:.L: < %. > < ( ) $ l *

y X

0

1 2

3 4

I

I

9

I

I I

I

I

I

I I

5 6

7 8

I

I I

I I I

I

I

I

I I I

I

I

I

I I

I

I

I

I

I

I

I I

I I

I I

I

I I

I

I I

Hollerith code for symbols Example 2.11 Here is some FORTRAN code. Each line is punched on a sep­ arate card. The first five columns are for statement numbers, but typing 'C' in the first column indicates a comment. Program statements begin at column 7. Columns 73-80 are ignored by the FORTRAN compiler. These columns are often used for sequence numbers so the cards can be put back in their proper order if the deck of cards is dropped. Figure 2.6

PROGRAM BINOMIAL

c

COMMENTS LOOK LIKE THIS INTEGER N, K, M, L , I N=5 K=2 M=1 L=N DO 1 0 I=1 , K M=M*L/I L=L - 1

10

CONTINUE PRINT M END

This program computes the binomial coefficient (�) = m . The output of the program is the number 10. Note that in Algorithm 1.1, the expression ptfb is an integer because b divides pt. Thus in this program, M*L/I is always an integer. 5See http:/ jwww.cwi.nt;-dik/english/codes/80col.html for a description of several varia­ tions on codes for 80-column cards.

). HOLLERITH CODES

37

roblems 2.6 L Why is there a slant cut in the upper left corner of the IBM cards?

2. Give three examples of a pair of punches in a column of an IBM card which does not represent a character in the Hollerith code used by CDC.

3. How many characters could be encoded using at most two punches per column?

4. How many characters could be encoded using at most three punches per column?

5. How many characters could be encoded using exactly four punches per column?

6. How many characters could be encoded using exactly five punches per column?

Chapter 3

Euclidean Algorithm The Euclidean algorithm was stated by Euclid in his Elements over 2000 years ago. It is still the most efficient way to find the greatest common divisor of two integers . . Before investigating the Euclidean algorithm, we take a look at the mod function. This function can be used to define modular arithmetic, which is used extensively in applied algebra. 3.1

The Mod Function

When you look at an analog clock, you can't tell how many times the hour hand has gone around the clock-you only see where the hand is currently pointing. The clock uses mod 12 arithmetic. If it is now 9:00, then 5 hours later it will be 2:00. Thus, on a clock, 9 + 5 = 2. We describe this by saying that 9 + 5 mod 12 = 2 We also do this for integers other than 12. Definition 3.1 (The mod function) If n and m are integers with m

then we define

>

0,

n mod m = n - Ln/mJ m

If we rearrange this equation, we see that each integer n can be written an integer multiple of m plus a remainder which is one of the numbers 0, 1 , 2, . . . , m - 1 : n = Ln/mJ m + n mod m as

We say that when we divide m into n, we get a quotient q = Ln/mJ and a remainder r = n mod m. ·Do you see why the n mod m is one of the numbers 0, 1 , 2, . . . , m - 1? 39

CHAPTER 3. EUCLIDEAN ALGORITHM

40

The computation of the quotient, ln/mJ , and remainder, n mod m, is the

division algorithm.

We can write the quotient in terms of the remainder n - n mod m ln/mJ = m so if a programming language implements the function n mod m, we can compute the quotient ln/mJ without having to form the floating point number nfm. On the other hand, the definition of n mod m given above is easy to execute on any hand calculator where everything floats. Example 3.2 Let n = 23 and m = 7. Then

23 mod 7 = 23 - l23/7J 7 = 23 - 3 . 7 = 23 - 21 =2 On a calculator, you would form 23/7 = 3.285 . . . , drop the decimal part to get 3, multiply that by 7 and subtract from 23 to get 2. To compute the base b representation of a positive integer n, we modify Algorithm 2.1 slightly (see Algorithm 3.1). Algorithm 3.1 Base b representation Input: Positive integers b and n, where b 2:: 2 Output: The base b representation of n = ( ak ak -1 . . . a2 a 1 ao ) b Set i = 0 While n > 0 do Set ai = n mod b Set n = (n - ai ) / b Set i = i + 1 End While Set k = i - 1 Return k, ao , a 1 , . . . , ak ·

Example 3.3 For the base 3 expansion of 74, we use the calculations

ao = 74 mod 3 = 2 a 1 = 24 mod 3 = 0 a2 = 8 mod 3 = 2 a3 = 2 mod 3 = 2

to find that (2202) 3 = 74. Indeed,

24 = (74 - 2) /3 8 = 24/3 2 = (8 - 2) /3 0 = (2 - 2) /3

'S.J.

.

.

THE MOD FUNCTION

41

The coefficient aj can be calculated directly using aj =

l � J mod b = l � J l bi:1 J b -

'

Example 3.4 For the base 3 expansion of 74, evaluate the sum

and replace the T by "3" . . On the other hand, the sum "

"

which is the base 3 representation of 74. Why is that? The mod function lets us define a new addition and multiplication on the sets {0, 1, 2, 3, . . . , m - 1} .

EB and ® on {0, 1, 2, 3, 4} by a EB b = (a + b) mod 5

Example 3.5 For m = 5 we define

a ® b = ab mod 5

The addition and multiplication tables are given in Table 3.1.

EB 0 1 2 3 4

0 0 1 2 3 4

1 1 2 3 4 0

Table 3.1

2 2 3 4 0 1

3 3 4 0 1 2

4 4 0 1 2 3

® 0 1 0 0 0 1 0 1 2 0 2 3 0 3 4 0 4

2 0 2 4 1 3

3 0 3 1 4 2

4 0 4 3 2 1

Addition and multiplication modulo 5

Problems 3 . 1

1 . Find the base 5 representation of the decimal number 9374. 2. Give the addition and multiplication tables for the integers modulo 3, where a EB b = (a + b) mod 3 and a ® b = ab mod 3. Use the tables to solve the equations 2 EB x = 1 and 2 ® x = 1 .

3 . Give the addition and multiplication tables for the integers modulo 4, where a EB b = (a + b) mod 4 and a ® b = ab mod 4. Can you use the tables to solve the equations 2 EB x = 1 and 2 ® x = 1? Why or why not?

CHAPTER 3. EUCLIDEAN ALGORITHM

42

4. Give the addition and multiplication tables for the integers modulo 6, where a ffi b = (a + b) mod 6 and a ® b = ab mod 6. If a and b are in the set {0, 1, 2, 3, 4, 5}, can you always solve the equation a ffi x = b? For which choices of a and b can you solve the equation a ® x = b? 5. Give the addition and multiplication tables for the integers modulo 7, where a (fJ b = (a + b) mod 7 and a ® b = ab mod 7. If a and b are in the set {0, 1, 2, 3, 4, 5, 6}, can you always solve the equation a ffi x = b? For which choices of a and b can you solve the equation a ® x = b? 6. Give the addition and multiplication tables for the integers modulo 13, omitting 0 from the multiplication table. Describe the patterns that ap­ pear in the two tables. How are the patterns similar? How are they different?

7. Consider the alphabet as represented by the integers modulo 26, using the conversion table

Describe how you would design a word scramble that is based upon addi­ tion and/or multiplication modulo 26.

=

8. Solve the equation 4x + 3 = 7 in the integers modulo 1 1 . 9. Solve the equation 5x + 8

·

4 in the integers modulo 11.

10. Solve the system 2x + 3y = 5 3x + 4y = 2 of linear equations in the integers modulo 11.

11. Solve the equation x2 + 9x + 9 = 0 in the integers modulo 11. 3.2

Greatest Common Divisors

Every integer a is a divisor of 0 because 0 = 0 a. However, a nonzero integer n has only a finite number of divisors because any divisor of n must lie between - lnl and lnl . ·

Definition 3.6 An integer d is called a common divisor of a and b if it

divides both a and b; that is, if di a and dib.

f,'J.2: : GREATEST COMMON DIVISORS

43

\t: If either a or b is nonzero, then a and b have only a finite number of common

divisors.

Definition 3. 7 If a and b are integers that are not both zero, then the greatest common divisor d of a and b is the largest of the common divisors of a and

b.

We write the greatest common divisor of a and b as

d = gcd (a, b) Since 1 divides any integer, the greatest common divisor is always positive.

�t is convenient to set gcd (0, 0) = 0. Note that because every number divides 0,

there is, strictly speaking, no greatest common divisor of 0 and 0.

Example 3.8 To compute gcd ( 24, 32 ) , we can look at the divisors of 24

±1,

±

2, ± 3, ± 4, ± 6, ± 8, ± 12, ± 24

and the divisors of 32 ±1, ± 2, ± 4, ± 8, ± 16, ± 32 The common divisors of 24 and 32 are the numbers that are in both those sets, namely ±1, ± 2, ± 4, ± 8 Jt is easily seen that 8 is the greatest common divisor of 24 and 32. Thus, 8 = gcd ( 24, 32 )

Examining all the divisors of a and b is a way to find the greatest common divisor of small integers, but in cryptography we deal with integers that may be hundreds of digits long. We will present an efficient method for finding greatest common divisors of large numbers. First a few observations. Definition 3.9 The absolute value of a real number x

Jxl =

{ -x X

is

if X ;::: 0 if x < 0

Theorem 3.10 If a and b are integers, then gcd ( a, b) == gcd (JaJ , J bl ) . Proof. This is obviously true if a = b 0 . Otherwise, note that the divisors of a are the same as the divisors of J a J , and the divisors of b are the same as the divisors of JbJ. So the greatest common divisor of a and b is the same as the greatest com�on divisor of JaJ and JbJ. I It follows that to compute gcd ( a, b), we may as well assume that a ;::: 0 and b ;::: 0. =

Theorem 3.11 If a > 0, then gcd ( a, a) = a and gcd ( a, 0) = a.

44

CHAPTER 3. EUCLIDEAN ALGORITHM I

Proof. The largest divisor of a is a. Theorem 3.12 If a

and b are integers, then gcd (a, b) = gcd ( b, a ) .

Proof. The common divisors of a and b are the same as the common divisors of b and a. I Theorem 3.13 If a, b,

and k are integers, then gcd ( a, b) = gcd ( a + kb, b)

Proof. We will show that the common divisors of a and b are the same as the common divisors of a + kb and b. If d i a and dib, then a = xd and b = yd for some integers x and y . So

a + kb = xd + kyd = (x + ky) d which means that d is a divisor of a + kb, so d is a common divisor of a + kb and b. Conversely, if c is a common divisor of a + kb and b, then a + kb = xc and b = yc for some integers x and y. So a = xc - kb = xc - kyc = (x - ky) c so c is a common divisor of a and b. This shows that the set of common divisors of a and b is the same as the set of common divisors of a + kb and b, so gcd ( a, b) = gcd ( a + kb, b) . I The following corollary leads to an efficient method for computing greatest common divisors. Corollary 3.14 If a Proof.

and b are integers with b > 0, then gcd (a, b) = gcd ( a mod b, b) Recall that a mod b = a La j bJ b, so that a mod b = a + kb for k = -

- La f bJ . The result now follows from Theorems 3.12 and 3.13. I As gcd ( m, n) is always equal to gcd ( n, m) , we can write the preceding equa­ tion as gcd (a, b ) = gcd ( b, a mod b) which is the form we will use. Example 3.15 To compute gcd ( 24, 32 ) , we proceed

as

gcd ( 32, 24) = gcd ( 24, 32 mod 24 ) = gcd ( 24, 8 ) = gcd (8, 24 mod 8 ) = gcd ( 8, 0 ) =8

follows:

tl12; GREATEST COMMON DIVISORS

45

You get a less cluttered display of the running of this algorithm by simply printing out the sequence a, b, ro , r1 , r2 , . . where each term in the sequence is obtained by applying the mod function to the previous two terms. In this example, the sequence is 24, 32, 24, 8, 0 so .the gcd is equal to 8. The third term is 24 because we are taking 24 mod 32. .

Example 3.16 The calculation of gcd ( 31899744, 44216928 ) requires more steps.

Rep eated use of the mod function yields the sequence 31 899 744, 44 216 928, 31 899 744, 12 317 184, 7265 376, 5051 808, 2213 568, 624 672, 339 552, 285 120, 54 432,12 960, 2592, 0, so the gcd is 2592. The first two terms in the sequence

are the input. The computations for the third, fourth, and fifth terms are

31899744 mod 44216928 = 31 899 744 44216928 mod 31 899 744 = 12 317 184 31 899 744 mod 12 317 184 = 7265 376 Euclid gave an algorithm to compute the greatest common divisor over 2000 years ago: Algorithm 3.2 Euclidean algorithm Input: Integers a and b Output: d = gcd( a, b) Set b = Jbl While b > 0 do Set c = b Set b = a mod b Set a = c End While Return JaJ

The Euclidean algorithm produces a sequence of remainders r0 , r 1 , r2 ,

... :

= a mod b b mod ro = ro mo d r 1 = r1 mod r2

ro r1 r2 r3

=

For example, if a = 34 and b = 13, then the sequence is 8, 5, 3, 2, 1, 0. In general, if rn =1- 0, then rn+ l = rn - 1 mod rn . Since gcd (rn , rn+ l ) = gcd (rn - 1 , rn ) (see problem 9 ) , the number gcd (rn , rn+ l ) is a loop invariant in the Euclidean algorithm. The last nonzero remainder rm is the gcd because gcd ( rm , rm +l ) = gcd ( rm , 0 ) = rm . There is also a recursive version of the Euclidean algorithm (see Algorithm 3.3 ) . A recursive algorithm is one that calls on itself.

46

CHAPTER 3. EUCLIDEAN ALGORITHM

Algorithm 3.3 Euclidean algorithm (recursive) Input: Nonnegative integers a and b Output: d = gcd( a, b) If b 0 Then Set d = a Else Set d = gcd(b, a mod b) End If Return d =

The Euclidean algorithm computes gcd (a, b) in very few steps. Let ro , r 1 , r2 , . be the sequence of remainders: ro r1

Tn+l

= =

a mod b b mod ro Tn- 1 mod Tn for n 2: 1

We might as well assume that a > b > 0. The algorithm stops when rm = 0. How big can m be? We will give a fairly crude bound that is enough to show that the algorithm is quite fast. First we show that ro < a/2. Indeed, if b :::; a/2, then ro < b :::; a/2, while if b > a/2, then ro :::; a - b < a/2. For the same reason, T2i < 2i 2 / 2 for i 2: 1. Thus, each term in the sequence a, ro , r2 , r4 , . . . is less than half o f the pre­ i ceding one. So r2i < a · (1/2) + l . Choose the smallest i so that a :::; 2 i + 1 , so r2 i < 1 . Either r2 i = 0, or rm = 0 for some m < 2 i. Now a :::; 2 i+l exactly when log2 a :::; i + 1 . So i is the smallest integer such that 2 log2 a :::; 2i + 2 whence 2 log2 a > 2i. Also rm = 0 for some m :::; 2i. Thus rm = 0 for some m < 2 log2 a. For example, if a = 32, then the algorithm must stop at some m < 10 = 2 log2 32. If a is a one-hundred digit number, then log2 a is less than 336 so we know that the algorithm takes fewer than 672 steps. That's a pretty small number when you think about how many steps would be required to factor a one-hundred digit number by trying to divide it by smaller numbers. You would have to try to divide it by all numbers up to fifty digits, which would require over 1050 steps. The usual terminology for this situation is that the number of steps is O (log a) . That ' s pronounced "Big 0." It means that you can bound the num­ ber of steps by a constant times the logarithm of a. (For this notion it doesn't matter what logarithm you use because each is a constant times log2 .) r

-

Problems 3.2

1. Compute gcd(48, 72) by writing out all the divisors of 48 and all the divi­ sors of 72.

2. Compute gcd(168, 245) using Example 3.15 as a guide.

3.3. EXTENDED EUCLIDEAN ALGORITHM

47

. 3. Compute gcd ( 55 440, 48 000) by factoring 55 440 and 48 000 into prime powers. 4.

Compute gcd ( 40 768, 13 689 ) using a computer algebra system and the mod function. ·

5. Compute gcd ( 29 432 403, 22 254 869 ) by computing a sequence of quotients Qo, Q1 , . and a sequence of remainders ro, r1 , . . . , where Tn - 1 Tn Qn+1 + Tn+1 · 6. Compute gcd ( 2456513580, 2324849811 ) . .

.

=

7. Given two integers a and b that differ by 5, show that gcd ( a, b)

=

1 or gcd ( a, b )

=

5

8. Explain the role of the integer c in the Euclidean algorithm. 9. Verify that gcd (a, b ) gcd ( rk , Tk - 1 ) , where ro and Tn+1 Tn -1 mod Tn for n 2: 1. =

=

a mod b, r1

=

10. Let a MOD m

=

r Note that

=

b mod r0 ,

r, where �

m { aa mod mod m - m

if a mod m :::; m/ 2 if a mod m > m/ 2

m m 0, set qi +l = Lri - 1 /riJ and

'3:3� EXTENDED EUCLIDEAN ALGORITHM

49

ri+l is indeed the next remainder. Now set Xi+l = Xi-1 - Xiqi+l Yi+l = Yi-1 � Yi qi+ l Each of these last three equations has the same pattern. It remains to show that rk ax k + byk for each nonnegative integer k. We have seen that this is trivially true for k = 0 and k = 1, and we will show that it is true for k = i + 1 if it is true for k = i 1 and k = i. If ri - 1 = axi - l + byi - 1 and ri = axi + byi , then ri+l = ri-1 - ri qi+l = axi - l + byi - 1 - (axi + byi ) qi+l = a (xi-1 - Xiqi+l ) + b (Yi-1 - Yi qi+l ) = axi+l + byi+l Thus by the principle of mathematical induction,

so

=

-

rk = ax k + byk

for each nonnegative integer k. Eventually, and

rn = gcd (a, b) = axn + byn Thus the greatest common divisor of a and b can be written in the form ax + by. The expression ax + by is called a linear combination of a and b. I

The proof of Theorem 3.18 gives an algorithm for finding the integers x and y (see Algorithm 3.4) . Algorithm 3.4 Extended Euclidean algorithm Input: Integers a and b Output: Integers x, y, and d, where d = gcd ( a, b) = ax + by Set Yo = 0 Set xo = 1 Set do = a Set = 0 Set x Set d 1 = b Y1 = 1 1 While d 1 =/= 0 Do Set q = Ldo /d l J Set Y2 = Yl Set x2 = x 1 Set d2 = d 1 Set d 1 = do - qd 1 Set x 1 = xo - qx 1 Set Yl = Yo - qy 1 Set Yo = Y2 Set xo = x2 Set do = d2 End While Return [d, x; y] = [do , xo , Yo ]

50

CHAPTER 3. EUCLIDEAN ALGORITHM

Example 3.19 Let a

= 52 and b = 96. The extended Euclidean algorithm produces the numbers in the following table. do q xo Yo d l X1 Y1 0 96 0 52 0 1 0 0 96 52 0 44 52 2 44 8 -5 2 6 -2 8 4 6 0 24 - 3 4 Table 3.2 Extended Euclidean algorithm

1 -1 -1 -11 1 -11 1

1 1 1 - 1 -11 -11

From this table, it follows that 4 = gcd (52, 96)

=

(

-11) · 52 + 6

·

96.

The algorithm can be stated succinctly using matrices (see Algorithm 3.5) . Algorithm 3.5 Extended Euclidean algorithm (matrix version) Input: Integers a and b, not both zero Output: Integers x, y, and d where d = gcd(a, b) = ax + by Set

[ �� :� �� ] [ � � � ] d1 0 [ ddo1 xox1 YlYo ] [ 01 ldo1/d1j ] [ ddo1 =

While

=?

Do

Set

=

End While

=

Return [d, x, y] Example 3.20 Let a

[� [�

=

-

xo Yo x1 Y1

[do , xo , Yo ]

52 and b = 96. The steps of Algorithm 3.5 are

] [ 9652 01 01 ] = [ 5296 01 01 ] ] [ 9652 01 01 ] = [ 4452 -11 � ] - L96/52J 1 ] [ 52 1 0 ] [ 44 -1 !1 ] 2 44 -1 1 [[ 0� - L52/44J 1 [ 44 -1 2 1 - L44/8J ] 8 2 !1 ] = [ : -11 �1 ] [ � - L8/4J 1 ] [ 8 2 �1 ] [ � -11 ] 4 -11 24 - 3 1 1

- L52/96J

=

s

=

It follows that

.]

gcd (52, 96) = 4 = (

-11) · 52 + 6 · 96

�

¥3;3� EXTENDED EUCLIDEAN ALGORITHM

51

The case where gcd ( a, b) = 1 is of special interest. Definition 3.21 If gcd ( a, b) = 1, then we say that a and b are relatively prime and write a ..l b.

So 12 and 35 are relatively prime, but 12 and 34 are not. If a and b are relatively prime, then gcd (a, b) = 1 so we can find integers x and y such that ax + by = 1 . The converse statement is also true. Theorem 3.22 If ax + by = 1 for some integers x and y, then a and b are

relatively prime.

Proof. Any positive common divisor of a and b must be a divisor of 1, so gcd ( a, b) = 1. Theorem 3.23 The greatest common divisor of two integers a and b is the

smallest positive integer d that can be written in the form d = ax + by where x and y are integers.

Proof. ( See problem 8 at the end of this section. )

Theorem 3.24 If a J bc and gcd ( a, b) = 1, then a J c.

Proof. ( See problem 9 at the end of this section. )

I

As a corollary to this theorem, we have a result often called Euclid ' s lemma. It is Proposition 30 of Book VII of Euclid. Corollary 3.25 (Euclid's lemma) If p is a prime and p J ab, then pJ a or p J b. Proof. Assume p is a ( positive ) prime and p J ab. If p J a there is nothing to prove, so assume p f a. Since the only positive divisors of p are 1 and p, it follows that gcd (p a ) = 1 . Thus p J b by Theorem 3 .24. I ,

Euclid's lemma extends to products of more than two factors. Corollary 3.26 If p is a prime and pJa 1 a 2 · · · a k , then pJ ai for some i . Proof. If p is a prime such that

Then by the previous corollary, p J a 1 a 1 · · · ak - 1 or pJ ak If P I Pk we are done. Otherwise, repeat this argument on p J ( a l a2 · · · a k -2 ) a k - 1 · Eventually, we get I p J ai for some i. .

CHAPTER 3. EUCLIDEAN ALGORITHM

52 Problems 3.3

1 . Use back substitution to find d = gcd (43, 56 ) and integers x and y such that d 43x + 56y. =

2. Use back substitution to find d that d = 27x + 68y.

=

gcd ( 27, 68 ) and integers x and y such

3. Use the extended Euclidean algorithm to find d = gcd ( 43, 56 ) and integers x and y such that d = 43x + 56y.

4. Use the extended Euclidean algorithm to find d = gcd ( 27, 68 ) and integers x and y such that d = 27x + 68y. 5. Use a computer algebra system to find integers d, x, and y such that d = gcd ( 742789479, 9587374758 ) = 742789479x + 9587374758y

6. Show that the greatest common divisor of two consecutive integers is 1 . 7 . Find d = gcd ( 4, 6 ) and integers x and y such that d = 4x + 6y by creating a table of values of 4x + 6y and picking the smallest positive value. 8. Prove Theorem 3.23. 9. Prove Theorem 3.24. 10. The least common multiple of two positive integers a and b is the smallest positive integer that is divisible by both a and b. Find an equation relating ab, the least common multiple of a and b, and gcd ( a, b) .

3.4 The set

The Fundamental Theorem of Arithmetic

= { 1 , 4, 7, 10, 13, 16, 19, 22, 25, . } consists of those positive integers of the form 3k + 1. It is the set of positive integers a such that a mod 3 = 1 . Call an element p of M a prime in M if M

. .

p > 1 and the only factors of p in M are 1 and p. The set of primes in M is { 4, 7, 10, 13, 19, 22, 25, . . } . Note that 1 is a unit and 16 4 4 is composite in M.

.

=

·

The surprise here is that 100 = 10 10 = 4 25, so 100 can be written as a product of primes in M in two essentially different ways. Can this happen in the set of all the positive integers? The fundamental theorem of arithmetic says that factorization of positive integers into primes is unique. Of course 2 2 3 and 2 3 2 are both ways of writing 12 as a product of primes, but they are not essentially different. We will show that the product is unique if we arrange the primes in order of size. ·

·

·

·

·

·

'lj;4; THE FUNDAMENTAL THEOREM OF ARITHMETIC

53

'I'heorem 3.27 {Fundamental Theorem of Arithmetic) Every integer greater

than 1 is either a prime or can be written uniquely as a product of primes.

Proof. We leave it to the reader to show that every integer greater than 1 is either a prime or a product of primes. We will show that an integer a can be written in only one way as a product of primes

a = P 1P2 · P k ·

·

with Pl ::::; P2 ::::; ::::; Pk · We do this by describing what those primes p1 , p2 , . . . , pk must be. The prime Pl is the smallest prime that divides a. Indeed, let q be the smallest prime that divides a. The extension of Euclid ' s lemma (the second corollary to Theorem 3.24) says that q divides one of the primes Pj · Since p1 is prime its only divisors are 1 and Pj , so q = P1 . But since q is the smallest prime that divides a, we must have q = P1 · Now we repeat the argument on ajp1 = P2P3 Pk · The prime P2 is the smallest prime that divides ajp1 . Similarly, the prime P3 is the smallest prime I that divides aj (P 1 P2 ) and so on. Edsger Dijkstra, a noted computer scientist, said this was a common but bad way to state the fundamental theorem of arithmetic. First of all, he said, you should consider a prime to be a product of (one) primes. So you can eliminate the phrase "is either a prime or." Second, you should consider the number 1 to be a product of zero primes ( note that 3° = 1), so you can replace the phrase "Every integer greater than 1" by "Every positive integer." It is often convenient to write the prime factorization as a product of prime powers, with the primes written in ascending order. For example, 10! = 2 8 . 3 4 . 5 2 . 7 1 ·

·

·

· ·

·

and

20! = 2 1 8 . 38 . 54 . 72 . 1 1 . 13 . 17 . 19 The fundamental theorem of arithmetic gives a way to picture the greatest common divisor. We can write any two integers as products of prime powers for the same primes: a = p�1 p�2 p�k and b = p{1 p�2 p£k , where some of the exponents ei or fj may be zero. Then •

•

• •

•

•

gcd ( a, b ) = plf_I p�2 · p1k • •

where gi = min ( ei , fi ) i that is, the exponent of each prime in gcd ( a, b) is the smaller of the exponents in a and b. Example 3.28 Consider 35640 = 2 3 34 5 11 and 7409556 = 2 2 3 7 7 . 1 1 2 . The greatest common divisor is 3564 = 2 2 34 5° 7° 11 1 . ·

·

•

•

•

·

·

·

·

This picture does not usually make the greatest common divisor easier to compute because the Euclidean algorithm is the world ' s greatest algorithm while factoring large numbers into primes is generally quite difficult.

54

CHAPTER 3. EUCLIDEAN ALGORITHM

Definition 3.29 The least common multiple lcm(a, b) of two positive inte­ gers a and b is the smallest positive integer m such that aim and blm. Example 3.30 Given the integers 8625 and 14 835, we have

gcd (8625, 14 835) = 345 lcm(8625, 14 835) = 370 875 Note that gcd (8625, 14 835) lcm(8625, 14 835) = 345 370 875 = 127 951 875 = 8625 . 14 835 ·

·

The next theorem shows that this is no accident. Theorem 3.31 The least common multiple of two positive integers a and b is

given by

lcm (a, b) =

ab gcd (a, b)

Proof. Let d = gcd (a, b) and z = ab/d. We will show that z is the least common multiple of a and b. As d divides both a and b, we have z = a (b/d) = (a/d) b is a multiple of both a and b. Now write d as ax + by and suppose that m is a common multiple of a and b, say m = sa = tb. Then

zd zd m = s- = tb a

so

ma = ztd and mb = zsd

and so md = m(ax + by) = max + mby = ztdx + zsdy = z (tx + sy) d

Cancelling the d on both sides gives m = z (tx + sy) so m is a multiple of z and therefore is at least as big as z. So z is the least common multiple of a and b . I Problems 3.4

In problems 1-7, M = {1, 4, 7, 10, 13, 16, 19, 22, 25, . . }. .

1 . List the next six elements after 25 in M. 2. List the next six primes after 25 in M. 3. List the first six composites in M. 4. Show that if a = 3k + 2 and b = 3m + 2, then ab is an element of M.

@i!J, MODULAR ARITHMETIC

55

5. Show that if p = 3k + 2 and q = 3m + 2 are ordinary primes, then pq is a prime in M. 6 . Find three distinct factorizations of 1870 as a product of 2 primes in M . . 7. Show that if a = 3 s + 2, b = 3t + 2, c = 3u + 2, and d = 3v + 2 are distinct ordinary primes, then (ab) (cd) = (ac) (bd) = (ad) (be) is an example of an element of M that has three essentially different prime factorizations. 8. Use a computer algebra system to write 1000! as a product of powers of primes. Use a direct argument to verify that the exponent on the prime 2 is correct. 9. Use a direct argument to explain why 1000! ends in 249 zeros. 10. Use a computer algebra system to write 2 20 + 20! as a product of powers of primes. 1 1 . Prove that if a I n and b I n, then lcm (a, b) I n. 3.5

Modular Arithmetic

Earlier in this chapter, we looked at ideas related to constructing remainders modulo m. In this section we will build on those ideas. Given any positive integer m, we get a congruence relation on the integers as follows. D efinition 3.32 Given two integers a and b and a positive integer m, we say that a is congruent to b modulo m and write a = b (mod m)

if ml(a - b).

Theorem 3.33 The condition

b mod m.

Proof. Suppose that

a = b + mk, so

a=b

(mod m ) is equivalent to a mod m

ml(a - b), say a - b = mk for some integer k. amodm = (b + mk ) modm b + mk J m = b + mk - l m = b + mk - l� + kj m

= b + mk - ( l � J + k) m

= b + mk - l � J m - km

=b

- l�J m

=

b mod m

=

Then

CHAPTER 3. EUCLIDEAN ALGORITHM

56

Conversely, suppose that a mod = b mod m. Then a- La/mJ m = b- Lb/mJ m, which can be rewritten as a - b = La/mJ m - Lb/mJ m = ( La/mJ - Lb/mJ)m. Since La/mJ - Lb/mJ is an integer, it follows that mj (a - b). I Why the new notation a b ( mod m) ? The point here is to make things easier to remember. With this notation, which goes back to Gauss, many prop­ erties of divisibility look like familiar properties of equality. m

=

Definition 3.34 A set C of integers is a m if for each integer

unique c in C such that a = c (mod m ) .

The set

a

there is a

{0, 1 , 2, 3, . . . , m - 1 }

is the most common example of a complete residue system. It is called the least nonnegative residue system modulo m. Note that every complete residue system has exactly m elements. Theorem 3.35 Let m and d be positive integers and let a,

The following hold.

i. ii. iii. iv. v. vi. vii. viii.

b, c be any integers.

a = a (mod m ) . If a = b (mod m) , then b = a (mod m) . If a = b (mod m) and b = c (mod m ) , then a = c ( mod m) . If a = b ( mod m ) , then a + c = b + c (mod m) and ac = be ( mod m) . If a = b (mod m ) , then ad = bd (mod m ) . If a .l m and ab = ac (mod m ) , then b = c (mod m) . If gcd ( a, b) = d, then (a/d) .l (b/d). If gcd ( a, m) = d and ab ac ( mod m) , then b = c (modm/d). =

a - a = 0, it follows that m l (a - a). ii. As b - a = - (a - b), if m l (a - b), then m l (b - a). iii. If m l (a - b) and m l (b - c), then m l ((a - b) + (b - c)). But (a - b) + (b - c) = a - c. iv. As (a + c) - (b + c) = a - b, and ac - be = (a - b) c, if m l (a - b), then m l ((a + c) - (b + c)) and m l (ac - be). v. We use induction on d. If a = b (mod m ) , then a 1 = b 1 ( mod m ) . Assuming ak = bk ( mod m ) , we have Proof. i. As

''3;5, MODULAR ARITHMETIC

57

vi. If a ..L m and ab = ac (mod m) , then ml ( a ( b - c)) so m l ( b - c) which eans that b = c (mod m) . m vii. Assume c l ( a /d) and c l ( b /d) , say aj d = ex and b /d = q;. Then a = cdx and b = cdy, so cd is a common divisor of a and b. But d is the greatest common divisor of a and b, so cd :::; d. But this means that c = ±1 . It follows that ( a/ d) ..L ( b/ d) . viii. Let d = ax + my Then ml ( ab - ac) implies mk = a ( b - c) . Dividing by d gives (m/d) k = (ajd)(b - c) where m/ d and aj d are integers, so (m / d) I ( a/ d) ( b - c) . But (m/ d) .l ( a/ d) , so (m/ d) I ( b - c) ; that is, b = c (mod m jd) . I We will often be faced with the problem of solving the congruence .

ax = b (mod m)

for some integer x. The key to solving such a problem is the idea of an inverse modulo m. Definition 3.36 ( Inverse modulo m) If ab = 1 (mod m), then b is called an inverse of a modulo m and a - 1 mod m is the smallest positive integer b such

that ab = 1 (mod m) .

Theorem 3.37 The integer a has an inverse modulo m if and only if a ..L m. Proof. Suppose a has such an inverse, say ab = 1 (mod m) . Then m l ( ab - 1) implies mx = ab - 1 . We can write this as 1 = ab - mx. It follows that any common factor of a and m must divide 1, so a ..L m. On the other hand, if a .l m, then 1 = gcd( a, m) = as + mt means that 1 - as = mt and therefore ml(1 - as ) . That is,

1 = as (mod m) so s is an inverse of a modulo m. I If gcd(a, m) = 1 , then the extended Euclidean algorithm will produce inte­ gers s and t such that 1 = as + mt, and s will be an inverse of a modulo m. If gcd(a, m) > 1, then the extended Euclidean algorithm will reveal this, and a has no inverse modulo m. The mod functions can be extended to fractions with denominators relatively prime to the modulus. So (2/9) mod 35 = 8 because the inverse of 9 modulo 35 is 4 and ( 4 2) mod 35 = 8. In particular, if b is an inverse of a modulo m, and 1 :S b < m, then we write b = a - 1 mod m. ·

CHAPTER 3. EUCLIDEAN ALGORITHM

58

Algorithm 3.6 is a variation of Algorithm 3.5 that computes the inverse of a modulo m . Inverse modulo m Algorithm 3.6 Input: Integers a and m with m > 0 Output: Integer a -1 mod m or th� message "Inverse does not exist" Set

[ �� :� ] = [ � � ]

While d 1 =f. 0 Do Set

[ �� :� ] = [ � - ld!/dd ] [ ddo1 X1xo ].

End While If do = 1 Then Return a -1 = xo mod m Else Return 'Inverse does not exist ' End If

Example 3.38 To compute the inverse of 13 modulo 29, we use the following matrix calculations.

[ 01

1 - l3/1J

] [ 31 -29 ] = [ 01

9 -29

]

It follows that 13 - 1 mod 29 = 9. Checking, we see that 13 . 9 = 117 = 29 · 4 + 1 = 1 (mod 29) Since the first row of the new matrix is always the second row of the previous matrix, these calculations can be simplified slightly for hand calculations (see Algorithm 3.7).

jB;f). MODULAR ARITHMETIC

59

'.}Algorithm 3. 7 Inverse modulo m Input: Integers a and m with m > 0 Output: The inverse of a modulo m or the message that gcd ( a, m ) > 1 Set do = a Set d 1 = m Set xo = 1 Set x 1 = 0 While d1 "1- 0 Do Set q = Ldo / d d Set d2 = do - qd1 Set x2 = xo - qx 1 Set xo = x 1 Set x 1 = x2 Set do = d 1 Set d1 = d2 End While If do = 1 Then Return xo Else Return 'gcd ( a, m ) > 1 ' End If Example 3.39 Table 3.3 can be used to construct the inverse of 13 modulo 29.

q = Ldo / d d q=O= q=2= q=4= q=3=

L 13 / 29J L29/ 13J L 13 / 3J L3 / 1 J

Table 3.3

do = 13 dl = 29 d2 = 13 - 29 . 0 = 13 d2 = 29 - 2 . 13 = 3 d2 = 13 - 4 . 3 = 1 d2 = 3 - 3 · 1 = 0

x0 = 1 X1 = 0 X2 = 1 - 0 · 0 = 1 X2 = 0 - 2 · 1 -2 X 2 = 1 - 4 · ( -2 ) = 9 =

Calculating the inverse of 13 modulo 29

As soon as a zero appears in the d-column, the inverse is the previous entry in the x-column. Thus 9 = 13 - 1 mod 29. Example 3.40 Solve the congruence 13x = 19 ( mod 29 ) .

Solution. Multiply both sides of the congruence by 9 to get x = 9 · 19 = 171 = 26 ( mod 29 ) . As a check, you can multiply 26 13 to get 338 = 19 (mod 29 ) . ·

Problems 3.5 1 . Show that the congruence lOx = 14 ( mod 8 ) has the same set of solutions as the congruence 5x = 7 (mod 4 ) .

0

CHAPTER 3. EUCLIDEAN ALGORITHM

2. Find the inverse of 9 modulo 23 using the methods of this section. Check your answer by hand. 3. Compute 3/8 mod 13 and - 14/3 mod 17. 4. Compute 3/2 mod 35 and -3/14 mod 55. 5. Find the inverse of 34 modulo 113 using a sequence of matrix products. Check your answer by multiplication. 6. Use a computer algebra system to calculate the inverse of 28394325 modulo 849289528 and to check your answer. 7. Solve the congruence 7382784739x = 1727372727 (mod 2783479827). Check your answer by plugging your answer back into the congruence and using a computer algebra system to do the arithmetic. 8. Let n be an odd integer greater than 1. Show that

{ - -2- , . . . ' - 1 , 0, 1, . . . ' -2-1 } n-1

n

-

is a complete residue system modulo n. 9. Construct a multiplication table for the integers modulo 5 that uses the residue system n- 1 - -- , . . . ' - 1 , 0, 1 , . . . ' -2 2 (see Problem 8) . Find two solutions to the equation x2 = - 1 .

{ n- 1

}

1 0 . Solve the equation 93x + 4 7 = 61 in the integers modulo 101. 11. Solve the system 23x + 37y = 14 53x + 17y = 25 of linear equations in the integers modulo 101 . 12. Solve the equation x2 + x + 10 = 0 in the integers modulo li. 13. For which primes p does - 1 have a square root modulo p? 14. Does the matrix have an inverse in the integers modulo 5? If so, find it. If not, why not?

Chapter 4

C iphers

The history of America and of secret communications includes many examples of enterprising men and women who, with little in the way of resources, developed innovative devices and systems that have be­ come a part of this cryptologic legacy of freedom. One of the most inspiring stories is the creation of slave quilts in the early and mid1800s. The secret messages embedded in the quilts, some say, as­ sisted slaves from 'the South in their efforts to escape to freedom in the North. Each quilt contained a specific code or message that conveyed important information to those who were attempting the dangerous journey from the southern regions of the nation to the free states and Canada. National Security Agency web site

People have disguised messages for as long as written languages have been used. A cipher is a method for disguising messages by replacing each letter by another letter, by a number, or by some other symbol. 4. 1

Cryptography

Definition 4.1 Cryptography is the art of disguising messages so that only friendly eyes can read them. The original message is called the plaintext; the disguised text is called the ciphertext. Encryption is going from plaintext to ciphertext. Decryption is going from ciphertext to plaintext. The goals of a cryptographer are: 1.

To provide an easy and inexpensive way for an authorized user to encrypt and decrypt messages 61

CHAPTER 4. CIPHERS

62

2. To make it difficult and expensive for an unauthorized user to decrypt the ciphertext We will normally write plaintext in lowercase letters and ciphertext in up­ percase letters. Caesar Cipher In the method of encryption attributed to the Roman emperor Julius Caesar, the lower case plaintext letters are replaced by upper case ciphertext letters according to the following scheme: b

a

l

l

c

l

D E F 0

Q

R s

l

l

f

g h

G H

I

J

K L M N

0

p

s

t

u

y

z

T u v w X y z A B

c

l

l

l

l

p q

n

j

e

d

r

l

l

l

l

l

l

l

i

l

l

v

w

l

l

k 1

l

X

l

l

l

m

l

l

Caesar cipher

Table 4.1

Note that the ciphertext alphabet is shifted to the left by three, and the letters A, B, and C are put on the end. We can give a formula for this cipher by thinking of the letters A through Z (or through ) as corresponding to the numbers 0 through 25 as shown in Table 4.2. a

z

A

B

c

D

E

F

G

H

I

J

K

0

1

2

3

4

1

5

6

7

8

9

10 1 1 1 2

N

0

p

Q

R

s

T

u

v

w

X

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

L

1

y

1

M

1

z

1

13 14 15 16 17 18 19 20 21 22 23 24 25 Letters are numbers

Table 4.2

In the Caesar cipher, the formula

y = ( x + 3 ) mod 26

is used to encrypt and the formula x

= (y - 3 ) mod 26

to decrypt. To encrypt the letter f, which corresponds to 5, we form the sum 5 + 3 = 8, which corresponds to the letter I . To encrypt the letter y, which

63

CRYPTOGRAPHY

tresponds to 24, we form the sum 24 + 3

=

27 and reduce modulo 26 to get 1, = -3

5,�!' Which corresponds to the letter B. To decrypt the letter A, we form 0 - 3 \�---- which is 23 modulo 26, so A decrypts to x .

The arithmetic of encrypting with the Caesar cipher is shown by the arrows

in Table 4.3. a

l

b

c

e

i

j

k

3

4

5

l

h

2

l

g

1

l

f

0

l

d

6

7

8

9

10 1 1 1 2

3

4

5

6

7

8

9

10 11 12 13 14 15

D

E

F

G

H

I

J

K

L

M

N

0

p

n

0

p

q

r

s

t

u

v

w

X

l

y

l

z

16 17 18 19 20 21 22 23 24 25

0

1

2

Q

A

B

c

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

l

m

l

l

l

l

13 14 15 16 17 18 19 20 21 22 23 24 25 l

l

l

l

l

l

l

R

l

T

s

l

l

l

l

v

u

l

l

w

l

l

X

l

l

y

l

l

z

l

l

l

l

a

c

a

e

s

r

c

i

4

2

0

4

18 0 17

5

3

7

l

l

8

22 10 7

l

2

21 3 20

5

11

w

K

H

F

D

H

v

D

u

F

L

p

h

e

r

i

s

e

a

s

y

15

7

4 17

8

18

l

4

0 18 24

18 10 7 20 1 1 2 1

7

3 21

H

D

h

e

19

7

l

l l

l

l

l

s

l

l

l

l

l

l

K

l

l

l

l

l

l

H

Table 4.4

l

Caesar cipher arithmetic

Table 4.3

t

l

l

l

l

l

l

l

l

l

u

l

l

l

l

L

l

l

l

l

l

l

v

l

l

l

l

l l

l

l

l

l l

l

l

l

v

l

l

l

l

l l

l

l

1

l

B

Caesar encrypting

4.2 The plaintext "the caesar cipher is easy" becomes the ci"WKH FDHVD U FLSKHU LV HD VB" as shown in Table 4.4

top to bottom. Each letter in the plaintext is replaced by its corresponding

CHAPTER 4. CIPHERS

64

number, the numbers are shifted by the formula y = (x + 3) mod 26, and finally each number is replaced by its corresponding letter. Decryption is done in the reverse order, from bottom to top.

Vigenere Cipher The Caesar cipher is completely described by the string of letters D E F G H I J K L M N O P Q RS TUVWXYZABC

which is the ciphertext for the plaintext abcdefghijklmnopqrstuvwxyz: a b c D E F p

n

o

Q

R S

d e G H

f I

g h i j k J K L M N

l 0

m

P

q r s t u v w x y z T U V W X Y Z A B C

A rearrangement of the twenty-six letters is called an alphabet. The Caesar cipher is one of the twenty-six shift ciphers. Each shift cipher has an alphabet starting with a different letter. Here are the alphabets for two other shift ciphers, shifting by 10 and shifting by 24: KLMN O P Q R S TUVWXYZABCDEF GH I J Y Z A B CD E F G H I J K L M N O P Q R S T U V W X

A monoalphabetic cipher uses just one alphabet. A polyalphabetic cipher uses different alphabets for different positions in the text. The simplest polyalphabetic cipher is the Vigenere cipher which uses the twenty-six shift ciphers. Often the alphabets used in a Vigenere cipher are described by a key word. For example, if the key word is CLINT, then we use the alphabets

starting with those letters:

CDEFGH I JKLMN O PQRSTUVWXYZAB LMN O P Q RS TUVWXYZABCDEFGH I J K I J K L M N O P Q R S T U V W X Y Z A BC D E F G H N O P Q R S T U V W X Y Z A BC D E F G H I J K L M T U V W X Y Z A BC D E F G H I J K L M N O P Q R S

The first letter of plaintext is enciphered using the first alphabet, the second letter using the second alphabet, until we reach the sixth letter of plaintext which is again enciphered using the first alphabet and so on. So the word attack would be enciphered as CFCNVM. Notice that the first and third letters

,]1' ;

65

CRYPTOGRAPHY

(�f. the ciphertext are the same, but the first and third letters of the plaintext are different. Also the second and third letters of the plaintext are the same,

but the second and third letters of the ciphertext are different. 1

Affine Ciphers The Caesar cipher is a special kind of affine cipher. D 4.3 An affine cipher is given by y = (kx + s) mod 26, where x is 'thefinition e plaintext integer, k is the multiplier, and s is the shift. If k = 1, the cipher is called a shift cipher.

, For the Caesar cipher, k = 1 and s = 3. If gcd ( k, 26) = 1 , then the equation can be solved uniquely for x

y = ( kx + s) mod 26 x = j (y - s) mod 26

where jk = 1 (mod m) . If gcd(k, 26) > 1, then different plaintexts will give the same ciphertext, so the ciphertext cannot be uniquely decrypted. For example, if k = 8 and s = 0, then we get the encryption shown in Table 4.5. Notice the ambiguity holds for friend and foe alike. A

!

B

1

c

1

D

1

E

1

F

1

G

1

H

1

I

1

J

1

K

w

X

1

L

M

1

1

0 8 16 24 6 14 22 4 12 20 2 10 18 N

1

0

1

p

1

Q

!

R

1

s

!

T

1

u

1

v

1

1

1

z

y

1

!

0 8 16 24 6 14 22 4 12 20 2 10 18 Table 4.5

Ambiguous encryption

Example 4.4 To encrypt the message

Short ciphers are hard to break using the affine cipher y = (9x + 7) mod 26, we break the message up into five­ letter groups and replace letters as in the following table: SHOR T

CIPHE

RSARE

HARDT

OBREA

K

NSDEW

ZBMSR

ENHER

SHEIW

DQERH

T

, 1To play with Vigenere ciphers, go to http://www.math.fau.edu/Richman/viginere.htm. You will be able to encipher there using a key word. Can you figure out how to decipher there also?

66

CHAPTER 4. CIPHERS

In particular, 18 9 + 7 = 169 = 26 6 + 13 = 13 (mod m) , so S -"7 18 13 N. To decrypt, it is necessary to solve y = 9x + 7 (mod 26 ) for x in terms of y. First, we subtract 7 from both sides to get y - 7 = 9x (mod 26 ) . Since 9 3 = 27 = 26 + 1 = 1 ( mod 26 ) , it follows that 3 = 9 - 1 mod 26 and hence x = 3(y - 7 ) mod 26. In particular, 3(13 - 7) = 3 6 = 18 and hence N 13 18 s. ·

·

---t

---t

·

·

---t

---t

---t

There are 26 shift ciphers. The number of affine ciphers y = (kx + s ) mod 26 is 12 26 = 312 because there are 12 choices of k with gcd (k, 26 ) = 1 , and 26 choices of s . ·

Polyalpha}:)etic Ciphers Two or more affine ciphers can be used to construct a polyalphabetic cipher. For example, two affine ciphers can be alternated, as in the following example. Example 4.5 Encrypt the plaintext

The British are coming! using the affine cipher y = 5x + 7 mod 26 for the odd-numbered letters and y = 3x + 4 mod 26 for the even-numbered letters. So T --+ 19 --+ 5 19 + 7 mod 26 = 24 --+ Y ·

and

H --+ 7

--+

3 7 + 4 mod 26 = 25 ·

--+

Z

Table 4.6 yields the ciphertext YZB HOCYCTZ HDB KZOVRL. t

! 19

h

! 7

! ! 24 25 !

y

!

z

e

! 4

! 1

!

B

Table 4.6

b

! 1

r

! ! 17 8

! ! 7 14

!

H

!

0

t

! 19

! 2

! 24

c

y

!

!

s

! 8 ! 2

!

c

! 18

h

! 7

! 19

! 25

T

z

!

!

a

r

e

c

0

m

! 0

! 17

! 4

! 2

! 14

! 12

! 7

!

H

! 3

!

D

! 1

! 10

! 25

B

K

z

!

Polyalphabetic encryption

Problems 4.1 1. Use the Caesar cipher to encrypt the plaintext Hello.

!

!

n

! 8

! 14

! 21

0

v

!

!

! 13

g

!

6

! ! 17 11 !

R

!

L

67

CRYPTOGRAPHY 2.

Use the Caesar cipher to decrypt the ciphertext ZOVMQ LDOXM EVFPQ EBPZF BKZBL CPBZO BQTOF QFKD

3. Use the shift cipher y = x + 6 to encrypt the plaintext Encryption products with less than sixty four bits are freely exportable.

4. Use the affine cipher y = 5x + 7 mod 26 to encrypt the plaintext The width of a complete filled rectangle must be a divisor of the length of the message .

. ; 5. Use the Caesar cipher to decrypt the ciphertext JRRGE BH

6. Use the Caesar cipher to unscramble the ciphertext LDPJR LQJWR VSDLQ WRILJ KWDQD UPBZL WKRXW DJHQH UDODQ GWKHQ FHWRW KHHDV WWRIL JKWDJ HQHUD OZLWK RXWDQ DUPB

This statement is ascribed to Julius Caesar himself. 7. Unscramble the following ciphertext, which was encrypted using the affine cipher y x + 5 mod 26. =

HFJXF KNWXY JSHWD RJXXF

WNXHT SXNIJ WJIYT GJTSJ TKYMJ UJWXT SXYTM FAJJA JWJRU QTDJI UYNTS KTWYM JXFPJ TKXJH ZWNSL LJX

8. Use the Vigenere cipher with keyword SING to encrypt the plaintext There are two kinds of music: country and western. 9. Use the Vigenere cipher with keyword GOLF to decrypt the ciphertext

JFTAKTZWYVZBVIEYLCCIUIRM 10. Decrypt the ciphertext HEJGI JTTPU WHBDH UHPBH AMREH SBIUF IZOFT IZUJS IHVHU B

which was encrypted using an affine cipher y = mx + b mod 26, knowing that the plaintext begins with el.

68

CHAPTER 4. CIPHERS

1 1 . Encrypt the message You should be aware that encrypted communications are illegal in some parts of the world.

using a polyalphabetic cipher that alternates the use of the three affine ciphers f (x) = l lx + 2 mod 26 g (x) = 15x + 5 mod 26 h (x) = 19x + 7 mod 26 12. Decrypt the ciphertext DGFEH LDJNE DNPOF DEFHV LU

encrypted using a polyalphabetic cipher that alternated the use of the three affine ciphers f (x) = llx + 2 mod 26 g (x ) = 15x + 5 mod 26 h (x) = 19x + 7 mod 26

=

13. Plaintext is encrypted using the affine cipher y = 3x + 5 mod 26; then the ciphertext in encrypted again using the affine cipher y 15x + 4 mod 26. Give a simple equivalent to the compound cipher. 14. The affine cipher y = mx + b mod 26 has an inverse cipher for only 12 different choices of m. What is the effect of increasing the alphabet size from 26 to 27? How about 29? 30?

4.2

Cryptanalysis

Cryptanalysis is the art of breaking codes. For every coded message, there might be several unauthorized persons trying to learn what the message says. This could involve industrial espionage, electronic eavesdropping, or simple curiosity. The letter count for the first paragraph of this section is given in Table 4.7. The second column is the number of occurrences of each letter, while the third column gives the relative frequency. Are these relative frequencies typical? The fourth column gives the relative frequencies of letters from a large sample of written English. As you can see from the table, letters such as 'Y ' are over-represented in Paragraph 1 , while letters such as 'X' are under-represented. Although 'E ' has the highest relative frequency in both lists, 'S' is second in one list while 'T' is second in the other.

�f2t:

69

CRYPTANALYSIS

are in general ver, the relative frequencies of letters in the small sample t�oweemen t with that of the large sample. agre

r agreement between As the amount of text increases, we normally get betteexpec ted relative fre­ and their the relative frequencies of letters in the text sts to break codes . Very short quencies. This phenomenon is used by cryptanaly ages. :messages are usually much harder to break than long mess

Letter A B

c D E F G H I J K L M N 0 p Q R s T u v w X y z

, Table 4.7

Frequency 17 1 8 6 24 4 9 8 18 0 1 12 2 16 18 8 0 21 17 20 4 3 2 0 11 0

Relative Frequency 7.2% 0.4% 3.6% 2.7% 10.3% 1.8% 4.0% 3.6% 8.1% 0.0% 0.4% 4.9% 0.9% 6.7% 7.6% 3.6% 0.0% 9.0% 7.6% 8.5% 1 .8% 1 .3% 0.9% 0.0% 4.9% 0.0%

Expected Relative Frequency 7.3 % 0.9% 3.0% 4.4 % 13.0% 2.8% 1 .6% 3.5% 7.4% 0.2% 0.3% 3.5% 2.5% 7.8% 7.4% 2.7% 0.3% 7.7% 6.3% 9.3% 2.7% 1 .3% 1 .6% 0.5% 1 .9% 0. 1%

Letter count from selected text

y = (x + b) mod 26, was Example 4.6 If we suspect that a simple shift cipher, of the table count the frequencies of each letter and shift the left side

used, we the expected frequencies. 2 up until we get a good match with

at http:/ /www .math .fau.edu/ • . · 2 You can get frequency counts for any text you enter

-R.ichman/Liberal/freqs.htm.

CHAPTER 4. CIPHERS

70

Expected

Sample

11111111111111

II IIIII IIIII 1111111111111111111 1111 1111 11111111 1111111111 I 111111111 111111 1111111111111 111111111111 I

11111111111 11111111111 11111111111111111 1111 1111 IIIII 1111

Table 4.8

I J K L M N 0 p

14 2 5 5 19 4 4 8 10 0 1 9

Q

R s T u v w X

6

13 12 1 0 11 11 17 4 4 5 0 4 0

y

A B c D E F G

H I J K L M N 0 p

Q

A B c D E F

R s T u v w X

H

z

z

G

y

12. 191 1. 503 5. 01 7. 348 21. 71 4. 676 2. 672 5. 845 12. 358 0.334 0.501 5. 845 4. 175 13. 026 12. 358 4. 509 0.501 12. 859 10. 521 15. 531 4. 509 2. 171 2. 672 0.835 3. 173 0. 167

111111111111 .

II IIIII IIIII II. llllllllllllllllllllh IIIII lh IIIIII 111111111111.

I IIIII I 1111. 1111111111111 111111111111. IIIII I 1111111111111 11111111111 1111111111111111 IIIII II. lh

I

Ill.

Frequencies for shifted ciphertext

Table 4.8 was obtained from the ciphertext BEMVB

GGMIZ

AIOWE

ZQITL

QDQA Q

WVEIA

MAAMV

BQITT

GBPMN

IABMA

BNIKB

WZQVO

UMBPW

LSVWE

VA QVK

MBPMV

QUXZW

DMLIT

OWZQB

PUAPI

DMJMM

VQ VDM

VBMLB

PIBIT

TWECA

BWNIK

BWZUC

KPTIZ

OMZVC

UJMZA

BPI VE

MKWCT

LNWZU

MZTG

This matching scheme corresponds to the shift cipher y ( x + 8 ) mod 26. We use the inverse shift y ( x - 8 ) mod 26 to get the plaintext =

=

71

CRYPTANALYSIS

TWENT

YYEAR

SA GOT

RIALD

IVISI

ONWAS

ESSEN

TIALL

YTHEF

ASTES

TFA CT

DRING

METHO

DKNOW

NSINC

ETHEN

IMPRO

VEDAL "

GORIT

HMSHA

VEBEE

NINVE

NTEDT

HA TAL

LOWUS

TOFA C

TORMU

CHLAR

GERNU

MEERS

THANW

ECOUL

DFORM

ERL Y

It's not hard to insert punctuation and spaces to get the message: Twenty years ago trial division was essentially the fastest fac­ toring method known. Since then impmved algorithms have been invented that allow us to factor much larger numbers than we could formerly. Example 4. 7

Table 4.9 gives the letter frequencies for the ciphertext

RZDTZ

ECA TR

TBSPZ

GLCAD

RLO YZ

SYTVN

LCTRZ

KALRC

LXBCT

IDBCA

TDBCL

XRBRL

OCA TX

BR TZE

CA TTS

SLKCL

XXNGY

TDTCA

ZIZEA

TOIGL

HSTOR

CGB

This time, sliding the left-hand side up or down never gives a good match, · so we try the assumption that this is an affine cipher y = ( kx + s ) mod 26 rather than a shift cipher. The two letters that appear most frequently in the ciphertext are likely to correspond to plaintext letters such as e and t · that we expect to see often. In this case, T appears 16 times and C appears 12 times, so let us assume that in this cipher, e T and t C; that is, 19 = ( 4k + s ) mod 26 and 2 = ( 19k + s ) mod 26 ( since C 2, e 4, and T 19 t ) . To solve the system -t

-t

+-t

+-t

+-t

+-t

19 = 4k + s mod 26 2 = 19k + s mod 26 first eliminate s by subtracting the second equation from the first to get 17 = 1 1k mod 26 Multiply this equation by 19, which is the inverse of 11 modulo 26, to get k = 17 19 mod 26 = 1 1 ·

Substituting k

=

1 1 into the equation 1 9 = (4k + s ) mod 2 6 gives s = 19 - 4 11 mod 26 = 1 ·

If the ciphertext is given by y = 1 1x + 1 mod 26, then to decrypt the ciphertext we must solve this equation for x in terms of y. We have 1 1x y 1 mod 26 and 19 is the inverse of 1 1 modulo 26, so =

x = 19 ( y - 1 ) mod 26 = 19y + 7 mod 26

-

72

CHAPTER 4. CIPHERS

Expected

Sample

7.884 IIIIIIII 0.972 3. 24752 IIll. 4.14.04 IIIII 3.1. 728 024 11111111111111 Ill II 1111 H 3. 78 I 7.0.216 992 111111111111 Ill 0.324 II L 3. 78 1111111111 2. 7 1111Ill 8.7. 424 11111111. II 992 11111111 1111 2. 916 Ill I Q 0. 3 24 R 8. 316 111111111 111111111 9 6. 804 IIIII 1111111 T 10.044 1111111111 111111111111111 2.1. 404 916 Ill I 1.0.54728 III. IIIII 2. 052 II Ill z 0.108 IIIIIIII 8 Table 4.9 Simple shift fails Applying this to the ciphertext, and then inserting the appropriate spaces and punctuation, we get IIIIIIII 8

1111111 111111111111 IIIII Ill

A

7 12 5

B c D

0 4 1

F

3

3

0 2 10 0 2 4 1 0 5 15 0 1 0 5

3

E

G

I

J K

I

M N 0 p

I

s

u v w X y

I

Some of these algorithms involve quite sophisticated mathematics, as in the case of the elliptic curve method of Hendrik Lenstra. Example 4.8

Matrix algebra can also be used to solve the system 19 4k + smod26 2 19k + smod26 of congruences. The system is equivalent to the matrix equation ( 1� � ) ( � ) mod 26 ( 1; ) or ( � ) = ( 1� � ) - l ( 1; ) mod 26 ( � ) =

=

=

=

1

(ti·

73

CRYPTANALYSIS

,-;-.

Problems 4.2 1.

The ciphertext ZNKUR JKYZQ TUCTK ' TIXEV ZOUTJ KBOIK OYZNK YIEZG RK

was encrypted using a shift

x + amod26 Determine a and decipher the message. 2. The ciphertext y =

DROBO KBODG YWKSX DIZOC YPMSZ ROBCK CELCD SDEDS YXMSZ ROBKX NKDBK XCZYC SDSYX MSZRO B

was encrypted using a shift

x + amod26 Determine a and decipher the message. 3. The ciphertext y =

RJUMK QRADU KSNMO MRUPS ZRGSH SWNPX OUKUM SZGSS PGJOK JJAPU LAKRD QRJUM AIUPO IUNMO SNM

was encrypted using an affine cipher kxmod26 Determine k and decipher the message The ciphertext y =

4.

AOEBX CPEWG UGUAZ BXAHC DEOEJ ANMZC DDCPU JDXCA ZBXAH CDEWA ZYAMW CNOEB XCPCV HMDXC WAGCO EBXCP DCFDZ CDDCP

was encrypted using an affine cipher = kxmod26 Determine k and decipher the message. y

74

CHAPTER 4. CIPHERS

5,

The ciphertext GWUUE OWAWC WJORE WEVCR

SWUMW HNEJA UNOJE SFDWV

JWWRA DGWRF VERLM WRSFD

CLWLP EJCQR JOFOR CHFDW

IMORL LFDWA SFDWG AIVOR

ORSEN IVORL WUUES LWJ

was encrypted using an affine cipher

smod26 Determine k and then decipher the message. 6. The two shift ciphers f (x) x + a mod 26 g (x) x + bmod26 were combined in a polyalphabetic cipher to construct the ciphertext y =

kx +

s,

=

=

VMGFT QWKLK PIKFP TYYTV

YKXVH SCQPF XTJEW TUJPI

Decrypt the message. 7. The two shift ciphers

CWNLQ XFLTE WNVJF OJUXC

WOFPB TFJVF GAYJJ LGXKS

f (x)

CXQSG NPGWU OFTNP VMGSC

THYJJ FUJNJ JETTU ACOQQ

VBGSV EYIWQ UNPBQ CSIZC

DPNPJ ZRTHN WNIYF LG

mod 26 bmod26 were combined in a polyalphabetic cipher to construct the ciphertext x+a g (x) = x +

ASPCA VYVQA PYJWB KEOPV OZDEO BOLOZ MPUDL PKVYH HUVGL JPYPT ATVYD HYKFA

JMTCP SLYHG OLDHO CPRPY PJZKP ALPJS OVYHW LUOUL ELCHY ZUJMC SPNOT LO

Decrypt the message.

JZKPA HUVNV PDWWH HWJZK DZYVL LDI JA KLAHV CLQZW ZLUOA VXASL UNSFK

=

LSVLC OLEHW JVQWS PHWVY OKPKT SLEOP ZKFZD CLDPO SLTYQ TYSVX PZAHC

ZLAEL RPYPE VEVRY NHPEO JLATV UOLAB LYHEV LYAAL HXPWP LDVYA ADVQH

YKPKE SPMPE LWSZP LUPEA YJPYP EFDLN CQZOY ELCZZ PZEYL SLYHG CPKVY

OPKPK ASLPE XFPAT SLULA TZUTL YPALY TNJLP UKHSA CPSPK HUVCL HYLHT

TJLAT SPMPE PUEHY TVYVQ DPYJW JVQKP YVQHC SLYHG EVEOP DLCCL PETJZ

SUBSTITUTION AND PERMUTATION CIPHERS 8.

The three shift ciphers

75

amod26 mod 26 cmod26 were combined in a polyalphabetic cipher to construct the ciphertext f (x) = x + g (x) = x + b h (x) = x +

DHNMO MOTJV KNBSF RILRE EONCE AUVYW EMKDR NNKBX ETCRR NDHEX DADDO SFCIM NXWNB ELROB ONOYB TQOIA ZRXPI NXCHS NWKVJ TOJXD NXGUS SQ

Decrypt the message. Substitution and Permutation Ciphers

� iP this section we look at two kinds of ciphers that do not have simple formulas. TlJ.e first is the general substitution cipher. Shift ciphers and affine ciphers are �· ;c �U:bstitution ciphers. ·

Substitution Ciphers ;-.. Definition 4.9 A substitution cipher is a one-to-one function from the set {A, B, C, , Z} onto itself.




. ·

7

X

X

CHAPTER 4. CIPHERS

76

ways.This table is a clumsy way to present We will investigate more efficient Substitution ciphers are special cases of permutations. O" .

Definition 4.10 A permutation is a one-to-one function from a finite set onto itself.

We will developfor aa particular more concise notation onfor {0,a permutation. Here is our current notation permutation 1, 2, 3, 4, 5, 6, 7, 8, 9}: 0 1 2 3 4 5 6 7 8 9 L

L

L

L

L

L

L L

L L

5 8 4 1 6 9 2 0 3 7

Wepermutation write thisuntil moreweconcisely by where startingwe with 0 and repeatedly applying the return to started 0 5 9 7 0. This is called a cycle, and we write it simply as (0 5 9 7) . Now repeat the process starting with 8the first element that has not yet appeared, so we start with 1 and get 1 3 1 which we represent as (1 8 3). Finally, we get 2 4 6 2 which we represent as (2 4 6) . Note that each integer from 9 appears in exactly one of these cycles. The first, (0 5 9 7) , is called0 through a 4-cycle and the other two are called 3-cycles. Finally, we write the permutation as -t

-t

-t

-t

-t

-t

-t

-t

-t

-t

(0 5 9 7) ( 1 8 3) (2 4 6)

= = = since each corresponds to the cycle

It doesn't matter where you start in a cycle. In fact, (0 5 9 7)

(7 0 5 9)

(9 7 0 5)

(5 9 7 0)

u The procedure can be used to write any permutation as a product of disjoint L

9

cycles.cycle.The cycles are called disjoint because no symbol appears in more than one A cycle can be thought of as a permutation by defining xr x for each x not in the cycle. The same is true for a product of disjoint cycles. With this interpretation, we state the following theorem. r

=

Theorem 4.11 Every permutation can be written as a product of disjoint cy­ cles. Proof. (

See problem 9.)

I

SUBSTITUTION AND PERMUTATION CIPHERS

a=

1

i

77

(0 3 2)(1 9 6 8 7 S)(4)

-----+

9

-----+

6 l

7 -- 8

s

invert abecause cycle, justreversing reversethethe arrows arrows.below The 4-cycle S) hasgives (2 S 4the7) itsTo inverse in the (2left7 4square

uu

4i 4l particular, a 2-cyclea isiswritten its ownasinverse, as isofa disjoint 1-cycle. cycles then a- 1 is the If a permutation a product product ofthe inverses of these cycles. For example, if a = (0 8 2 S)(1. 4)(6 9 7) then a- 1 = (0 S 3 2 8)(1 4)(6 7 9). 3

. Definition 4.13 To obtain the product aT of two permutations, first apply a :.then apply T. That is, x u r = ( xu ) r . ;Example 4.14 Let a = ( 0 S 9)(1 8 4 2 3 7 6) and T = (0 1)(2 S 8) (3 4 6 9 7). 2UT = (2ur = 3T = 4 and sur = (su r = 9 T = 7. The product aT can be ':�' wThen ritten as a product of disjoint cycles: aT = (0 S 9)(1 8 4 2 3 7 6)(0 1)(2 S 8) (3 4 6 9 7) = (0 8 6) (1 2 4 7 9) (3) = (0 8 6) (1 2 4 7 9) s

s

Theorem 4.15 The inverse of a product aT can be written as

· · Proof.

(See problem 10 . )

I

78

CHAPTER

4.

CIPHERS

Example 4.16 Let a = (0 5 9) (1 8 4 2 3 7 6) and T = (0 1 ) (2 5 8)(3 4 6 9 7). Then

T -1 a -1 = (0 1) (2 8 5)(3 7 9 6 4) (0 9 5)(1 6 7 3 2 4 8) = (0 6 8) (1 9 7 5 4 2) (3) = (aT ) - 1

ciphers,0,it1,is .convenient to use directly the lettersWhenA, working B, . . . , Zwith ratherpermutation than the integers . . , 25. Example 4.17 Use the substitution cipher a = (A P H I T X) (B E R C) (D N Z F

V

M)(G J K W L 0 Y Q S U)

to encipher the plaintext If it isthen correcta solution that thewillinscription rectangle is completely filled, be obtained by rearranging the column so to form plaintext. Note that I---+ T, F----+ V, and so forth. Repeating this process for each plaintext character, we get as

TVTXT

UBYCC

RBXXI

PXXIR

TZUBC

THXTY

PZJOR

TUBYD

HORXR

OQVTO

ORNXI

RZPUY

ZCRBX OGXTY

ZL TOO

ER YEX

PTZRN

EQCRP

CCPZJ

TZJXI

RBYOG

DZUYP

UXYVY

CDHOP

TZXRA

X

left.The plaintext can be recovered by reading the permutation a from right to For matrices small n, permutations on {1, 2, . . . , n} can be computed using permu­ tation Boolean matrix. The permutation a = (1 4 2 5 3) corresponds to the 5 5 x

s�U H Hl

where Sij = 1 if and only if i{T = j. To evaluate 3{1 you can compute the matrix

�,?J, ' SUBSTITUTION AND PERMUTATION CIPHERS �/:·:, ·

(o o

1

o o)

(H H �]

0 1 0 0 0 =( 1 0 0 1 0 0

79

o o o o)

This indicates that 3"" = 1. Given (1 3 2 4 5) and the corresponding matrix .O; f ,

T =

note that the permutation product aT = (1 4 2 5 3) (1 3 2 4 5) = (1 5 2) (3) (4) corresponds to the matrix product

(H H �l (� H Hl (� H Hl

ST = 0 1 0 0 0 0 0 1 0 0

01 00 00 00 01 = 00 01 00 01 00

Permutation Ciphers

In contrast toletters a substitution cipher, afixed permutation cipherThe rearranges the string plaintext according to a permutation. ciphertext is an anagram of the plaintext. of

pefinition 4. 18 A permutation cipher of length m permutes letters in blocks of length m using a fixed permutation.

Permutation ciphers cannot besayattacked bythere usingarecharacter frequencies. How­ ever, if the block length is small, = 9, only 9! = 362 880 permu­ tations to try in order to break the cipher. Example 4.19 Let a = ( 1 47) (238956) be a fixed permutation of {1, 2, 3, 4, 5, 6, 7, 8, 9}. First break up the plaintext m

80

CHAPTER 4. CIPHERS

Streamhigh ciphers where speedareandoftenlowused delayin areapplications required into blocks of length 9 as follows STREAMCIP HERSAREOF TENUSEDIN APPLICA TI ONSWHEREH IGHSPEEDA NDLOWDELA YAREREQUI REDEXTRAS

where extra letters are added at the end so that the last block will have nine letters. Now apply the permutation a to each block to get ERICMTSPA SROEREHFA UNIDEETNS LPTA CPA II WSERENOHH SHDEEGIAP OLLEDDNA W ERUQEA YIR EDAR TERSX

The encryption of the first few letters is shown in Table 4.11. Note that the letters in each block are rearranged, but the letters are unchanged. s

!

1

! 4 !

E

T

R

2

3

!

!

3

!

R

E

! 4 !

!

!

8

7

!

!

I

c

A

M

5

6

!

!

6

!

M

!

!

2

!

T

c

!

7

!

1

!

s

I

!

8

p

!

9

!

!

p

A

9

!

5

!

Permutation cipher Substitution ciphers are often used in combination with other ciphers. For example, used toor gia vblock e a correspondence letters anda substitution numbers; thencipheran may affinebecipher cipher (such asbetween those introduced in the next section ) may be added on top of the substitution. Although there are 26! = 403 291461 126 605 635 584 000 000 possible substitution ciphers, these can be broken by methods that involve counting character frequencies. Table 4. 11

Problems 4.3

1. Use the substitution cipher a=

(NEW) (MXICO) (STA) (UVRY) (BDFGHJK LPQZ)

to encrypt the plaintext,

I

live in Las Cruces.

SUBSTITUTION AND PERMUTATION CIPHERS 2.

81

The ciphertext VDPJV HJLIO LRLAD CL was encrypted using a substitution cipher with � = (COLRAD) (STE) (UNIVY) (BFGHJKMPQWXZ)

What is the plaintext? 3. Use a permutation cipher with

� = (1563) (24)

to encrypt the plaintext I have a secret. 4.

Decrypt the ciphertext ESCROUSEHWI WRESOBEIYUT

that was encrypted using a permutation cipher � = (1 5 2 4 8 9) (3 6 7 1 1 10) 5.

Use the substitution cipher � = � R P I H N C W G F B K O Q M U �� X Y T V S z E n

to encrypt the plaintext There is, of course, no difficulty in recognizing that a cipher is transposition and not substitution.

Verify that a product of disjoint cycles commutes; that is, if � and r are disjoint cycles, then = 7. If � = (0 4 7) (1 6 5 3) (2 9 8) and = (0) (1 3 5 9 7) (2 8 6 4) , express �T and r� as products of disjoint cycles. 8. Compute �- 1 , r - 1 , (�r) - 1 and (r�) - 1 for the permutations � and r given in Problem 7. 9. Prove Theorem 4. 11. 10. Prove that the inverse of a product �T of two permutations is given by (�r) - 1 = r - 1 � - 1 . (See Theorem 4.15.) ·

6.

x ur

x ru .

T

82 4.4

CHAPTER 4. CIPHERS

Block Ciphers

Incation this modulo section we26.look at block ciphersofthatcharacters are determined by matrixas multipli­ In this way, strings are enciphered blocks.let Consider an n n matrix M whose entries are in {0, 1 , 2, . . . , 25}, and x

be the row vector that corresponds to a string of n plaintext characters, and let Yn ) Y = (Yl Y2 be the row vector defined by y = xMmod26 We can use the row vector y as ciphertext. If M has a matrix inverse modulo 26, then the process y = xMmod26 is reversible and we have x = yM-1 mod26 In practice, block ciphers are secure only when the block size is relatively large. In the following examples, we use a small block size to illustrate the ideas. Example 4.20 Here is a small block cipher determined by matrix multiplica­ tion modulo 26. Let = 2 and take M= ( � � ) Todummy encodeletters the plaintext HELLO, first break it up into groups of two and add (R in this case ) to make it come out even: HE LL OR. Then convert the letter pairs into the number pairs (7 4) , (11 1 1) , (14 17) of integers. Next, compute the matrix products (7 4) G �) mod26 = (o 5) (11 n) G �) mod26 = (3 24) (1 4 17) G �) mod26 = (1 3) ·

n

· ·

83

BLOCK CIPHERS

convert back to letters. The ciphertext is AFDYBD. To recover the plaintext, we can compute the inverse of the matrix M: ( 32 95 ) - 1 mod 26 = ( 1517 256 ) The plaintext is recovered by multiplying the ciphertext by M- 1 : (0 5 ) G� 2:) mod26 = (7 4) (3 24) G� 2 5 ) mod26 = (1 1 11) 6 (1 3) G� 2:) mod26 = (14 17) Example 4.21 The plaintext If a portion of theobtained ciphertext is suspected to yieldinvolved some specific plaintext then the values for the cipher digraphs can be enteredin wherever those digraphs appear. This may in special situations result additional text being guessed. can be transformed into the ciphertext

by

YTQXE

DND YJ

MVFYI

UARFF

BOUVN

DESAK

PZSJQ

ZJHQW

CNVNQ

EGWPZ

IGPHM

PR VKH

HJPQF

YSXFY

ELKDS

SYYHA NRDSX

MOTHV

AEDFY

IUARF

FDMGY

FXNOC

UZOIZ

DBXLA

HJLRB

HFFLR

DBBOH

DWANV

UJQXN

XQXPZ

GHFYY

GCEQW

BZPZI

GKDCU

FL WRS

MBZLR

UCNMK

HYPTP

ND YJK

DHJPQ

RDKHK

GSSES

QZ

using the encoding (x 1 X2 )

(11 ;) mod26 = (Y1 8

Y2 )

pairs of letters. For example, the plaintext letters IF correspond to the humber pair (8 5) . The product 1 (8 5 ) C8 ;) mod 26 = (24 19) _gives the number pair (24 19) , which corresponds to the ciphertext YT. On

84

CHAPTER 4. CIPHERS

A

B

c

D E

F

G

H

I

J

K

L

M

N 0

p

Q

R

s

T

u

v

w

X

y

z

ciphertext

plaintext

A B CD E F G HIJKL M N O P Q R S T U V WX YZ

A B CD E F G HIJKL M N O P QR S T U V WX YZ

00000000001 001000200000000 00000001 000000200000000002 00001 000000001 000000200000 02000000000010000000000000 00020000000100000020000000 000003000001 00000000000150 00000001000000000000001 01 0 1 001 0000030000000000000000 00000020000000000000200001 OOOOOOOjOOOOOOOOOOOOOOOOOO 00030013000000000000000000 00000000000000000300000000 000000000000001 1 000001 0000 0003000000001 010000001 0100 00000000000000000000000000 00000001 000000002000000004 00001 000000000000000002302 0002000000000000000001 0000 0000000001 001 0000020000200 0000000100000001 0000000000 001 0000001 000000000001 0000 1 0000000000001000000000000 1 0000000000000000100000000 00000000000100000000000000 0000001 002000001 0001 00001 0 00000000000000100000000000

A

B

c

D E

F

G

H I

J

K L

M

N 0

p

Q

R s

T

u

v

w

X

y

z

0001 00001 00301 0301 01 000000 00002000000000000001 000000 0000000020000001 0001 000000 001 01 1 0010000000001 0001 000 002200000001 0200001 00101 00 00000000100000000000000000 0000001 00000000001 00000000 000030000000001 0001 0000000 000001 1 0000003120010000000 00000000000000000000000000 00000000000000000000000000 1 0000000000000000001000000 1 0000000000000000000000000 00001000000000000020010000 000001 000001 12000200000000 00004 001 000000000000000000 00000000000000000000000000 1 0013000000000000002000000 00001 0002000001 000201 00000 000030053000001 00000100000 0000200000000000001 0000000 00002000000000000000000000 00000000000000000000000000 00000000000000000002000000 00000000200000000000000000 00000000000000000000000000

Letter pair (digraph) frequencies of the ciphertext letters ofgivesranging a distribution that is values quite different A thecountcharacter from ciphers. Instead between typical and 0 . 13, the relative frequencies are in a very narrow range betweenof 0.0.000114 and 0. 066 . Toof pairs applyofcryptanalysis to such toproblems, it is thenecessary to appears look at frequencies letters. ccording Tabl e 4.12, pair A five times in the ciphertext and appears four times in the ciphertext. In the plaintext, appearsletter five times andthe English appearslanguage. four times.TheThepairletterispairmuch isfarther the most common pair in down onand the list of popularity. After comes the pairs Making the guess that leads to the equation (5 24) ( 19 7) (a n a 1 2 ) a2 1 a22 Table 4. 12

FY

PZ

th

on, an, en, at,

es.

pe

th

th--t

FY

=

th pe he, in, er, re,

�"�';pJ. [�¥:· tFr

85

BLOCK CIPHERS

' he second most common letter pairis There are several potential cipher' text pairs that could correspond to The lucky guess gives the equation he.

he.

he-----+

FF

(5 5) = (7

Putting these two equations together so

���) = Ci1 �) G 245 ) mod26 = 8 ;) C -1

The plaintext can be recovered by computing

In particular, the first two letters of the ciphertext correspond to 1 ( 24 19) ( 118 95 ) - mod26 = (8 5) which yields the two letters After inserting spaces and punctuation in ap­ propriate places, we recover the original plaintext If a portion . . . YT

if.

Problems 4.4

1. Use the block cipher Y = X ( � � ) mod 26 to encrypt the plaintext I spy.

2. Assume that the block cipher Y produce the ciphertext

=

X

( 173 �! ) mod 26 was used to

VX XC ZD HG WC RJ AR

Decrypt the message.

86

CHAPTER 4. CIPHERS

3.

Use the block cipher to encrypt the plaintext A substitution alphabet derived by a linear transformation on the normal sequence introduces at most two unknown quantities.

4.

Use the blck cipher Yd

u D

to encrypt the plaintext

7 3 1 3 7 9

87 61

69

4 9 3

mod26

Praise for their skill, speed, and accuracy accrued throughout the war. At Iwo Jima, Major Howard Connor declared, "Were it not for the Navajos, the Marines would never have taken Iwo Jima. " Connor had six Navajo code talkers working around the clock during the first two days of the battle. Those six sent and received over eight hundred messages, all without error.

What is the inverse cipher for the cipher given in Problem 4? 6. Assume a 2 2 block cipher of the form 5.

x

Y = XM was

used to produce the ciphertext BIMZU WEQRV QKWHT GHNKZ SEYTU GMMDP I ZUD

Decipher it.

PTTOG MSNAW TEMGT FHOCF OJHCE APUUN

VKI I C XCEIT YEUDK CMVCZ PESIZ HOIYD

DBGGJ TCJDO WWVIX XANOU FIZGX LIKTT

QCVFQ BTZQR MQZDS VRDDY QWVPE WSJGP

WXMKL GODEK ZZYGH DKAAE CQOAE OHOTA

TMANE NEMFD PPYDY WULQB ANEUM QBHCZ

UNXQR OKWVW TEDDO HGPSZ IVCLI FHCKG

?{{4.

BLOCK CIPHERS

87

7. Use the affine transformation

X -t

1 0 7 3 6 8 5 8 1

9 5 3 7 0 4 5 6 2

7 9 3 8 6 0 3 1 4

6 3 2 1 3 0 1 8 3

0 4 5 0 5 4 9 0 2

2 3 7 9 5 1 7 3 3

5 5 7 9 1 7 2 7 7 9 8 4 2 3 7 5 7 3

7 7 4 5 7 2 9 1 4

X+

5 5 8 8 6 5 4 3 0

mod 10

to encrypt your Social Security number. Compute the inverse transformation and test it on your encrypted Social Security number. 8. Use the 10

X -t X

x

10 block cipher 105 233 85 246 248 253 207 79 198 251 98 212 104 164 188 253 89 127 48 222 249 147 110 206 109 203 239 219 13 54

11 192 134 42 213 1 16 147 223 4 112

79 164 82 235 18 205 189 197 207 114

235 214 200 243 131 69 218 128 180 112

221 160 249 165 109 228 166 154 127 137

233 82 132 172 192 57 234 180 36 108

118 190 204 113 105 243 124 147 8 38

119 195 197 188 41 76 172 178 252 252

mod 256

to encrypt the message Technology and security experts oppose restrictions on encryption, arguing that such restrictions would damage consumer trust.

by breaking the message into blocks of 10 characters and using ASCII values for each character. Pad the plaintext with extra "#" so that the total number of characters is a multiple of 10. 9. The 10 x 10 block cipher 105 233 85 246 248 253 207 79 198 251 98 212 104 164 188 X -t X 253 89 127 48 222 249 147 110 206 109 203 239 219 13 54

11 192 134 42 213 1 16 147 223 4 112

79 164 82 235 18 205 189 197 207 1 14

235 214 200 243 131 69 218 128 180 112

221 160 249 165 109 228 166 154 127 137

233 82 132 172 192 57 234 180 36 108

118 190 204 1 13 105 243 124 147 8 38

119 195 197 188 41 76 172 178 252 252

mod 256

88

CHAPTER 4. CIPHERS

was used to generate the ciphertext 102 101 40 163 55 159 112 170 180

66 139 185 219 88 149 112 99 241

144 32 54 30 234 32 22 184 182

98 218 216 135 36 204 248 200 56

34 201 201 217 119 64 142 81 224

179 85 141 72 166 159 130 126 229

118 216 214 243 213 169 220 38 124

173 114 114 5 71 250 152 130 31

169 213 84 233 99 240 147 202 208

92 34 190 231 253 174 91 254 121

as described in problem 8. What is the plaintext?

4.5

The Playfair Cipher

Sir Charles Wheatstone3 (1802- 1875) is remembered by physicists for his con­ tributions to the rheostat and the Wheatstone bridge, by musicians as the de­ veloper of the enchanted lyre, and by cryptographers for his development and promotion of the Playfair cipher. This cipher was used by the British in the · Boer War and World War I, and by Lt. John F. Kennedy to arrange the rescue of his crew from a Japanese-controlled island after his PT-109 was sunk in the Solorrion Islands. The Playfair cipher is determined by writing the twenty six letters of the alphabet into a 5 x 5 matrix. To make it fit, the letters I and J are treated as one letter. Normally, one chooses a keyword to aid in this process, such as COLORADOSTATEUNIVERSITY. The keyword is written into the matrix, omitting repeated letters, and is followed by the remaining letters of the alphabet in alphabetical order. Several patterns can be used to enter the letters, including row by row or a spiral pattern. For example, the matrix c F B y v

0 G X w IJ

L H z Q N

R K M p u

A D s T E

was constructed by starting at the top left and spiraling clockwise in toward the center. The plaintext is then broken up into two-letter pairs. If the letters in a pair are the same, enter an X between them. If there is only a single letter in the last group, add an X. The plaintext The Playfair cipher was an immediate success 3 Search the web for summaries of the many contributions of Charles Wheatstone.

89

THE PLAYFAIR CIPHER

TH EP LA YF AI RC IP HE RW AS AN IM ME DI AT ES. UC CE SX SX

The ciphertext is generated two letters at a time by locating a pair of plain­ text letters in the 5 x 5 matrix. For example, the letters TH appear in the opposite corners of rectangle H

•

•

•

•

Q

•

T

D

so choose first the letter in the row with T, then the letter in the row with H. Replace TH with QD. In a similar manner, replace EP with UT. The letters in the LA both appear in row . choose the letter immediately to the right (with wraparound) . The pair LA corresponds to RC. The letters in the pair YF both appear in column

so choose the letter immediately below each plaintext letter. Thus YF corresponds to VB. Continue in this manner to get ciphertext as illustrated in Table 4.13. TH

EP

LA

YF

AI

IP

AS

VB

DE

AD

uw

l

RW

RC

l

HE

UT

l

RC

QD

l

DN

DP

DT

AN

IM

ME

DI

AT

ES

uc

CE

sx

sx

LE

ux

su

GE

DE

AT

VR

AV

BZ

BZ

l

l

l

l

l

Table 4.13

l

l

l

l

l

l

l

l

l

l

l

Playfair encryption

Reverse the process to decrypt a message. If the letters in a pair are in .different rows and columns, pick the opposite corners of the rectangle. If two · · letters appear in the same row, pick the letters immediately to the left. If two : letters appear in the same column, pick the letters immediately above them.

90

CHAPTER 4. CIPHERS

Problems 4.5

1. byCreatestarting a Playfair cipher using the keyword Ciphers are us in the upper left corner and following the arrows in diagram: CIPHERSAREUS (

--+

1 /' 1 /'

/ /' / /'

--+

--+

/ /' / /'

/ /' / /'

--+

)

1 / 1 / 0

Encipher the message Wheatstone named the Playfair cipher after his friend Lyon Playfair.

2. Create a Playfair cipher using the keyword CHARLESWHEATSTONE ( Charles Wheatstone) by starting at the center and following the arrows in the diagram: 0

i i i i

--+

i i i

+--

--+ --+

i

--+

1 1

+--

+--

+--

+--

1 1 1 1

+--

(Whenever you enter a new square, go in the direction indicated. ) Enci­

pher the message Wheatstone 's work in acoustics won him a professorship of experimental physics.

3. The keyword RHEOSTAT was used with the pattern 1

1

--+

--+

--+

+--

+--

+--

1

--+

--+

--+

+--

+--

+--

+--

--+

--+

--+

0

--+

--+

--+

+--

1

(starting in the upper left corner) to create the ciphertext

'·

91

THE PLAYFAIR CIPHER CSBXE FNTOV MROSK DHCOB LTASP ODEFB HILEC SSPOB RMHOP SMARK HOELT LKYBH

using a Playfair cipher. Decrypt the message. 4. The key AMMETERS ARE CONNECTED IN SERIES was used with the Playfair pattern ----+

----+

----+

----+

----+

----+

i i i

----+

i -

----+

l l r-

0 rr-

l l l l -

( starting in the upper left corner ) to create the Playfair ciphertext OGQME TRTSC MARZN RIRUR TIDFK EAMYB PMYB

Decrypt the message. 5. A variant of the Playfair cipher uses two squares, each generated using its own key. A pair of letters are located in the first square; then opposite corners of the second square are used as ciphertext. Thus IT ----+ DQ. If a pair of letters appear in the same row on the left, then the characters immediately to the right of the corresponding locations in the right box are used. •

•

•

•

•

•

•

•

•

•

•

•

I

•

•

•

•

•

•

D •

•

•

•

•

•

•

•

•

•

•

•

•

•

T

•

•

Q

•

•

•

•

•

•

•

•

•

•

•

•

The keywords SCIENTIFIC NOTEBOOK and MAPLE MUPAD were used to gen­ erate the pair s T A M v

c F D p w

I 0 G Q X

E B H R y

N K L u z

of squares. Decrypt the ciphertext

v w X y z

0 Q R s T

G H I K N

u D B c F

M A p L E

92

CHAPTER 4. CIPHERS DXOCX RTDIV SUOKC DLSBZ BDVKK LWNOB BUOMK UYXUV KHXWU VKYHZ DVZH

6. Another variant of the Playfair uses rectangles of other sizes and larger alphabets. For example, a 27-character alphabet fills a 3 x 9 rectangle. The key GADZOOKS was used to fill the rectangle E c

y F B

w I K

X H s

v J 0

u L z

R N A

T M D

Q

p G

and generate the ciphertext RVDVG SMFKX MWNSN RMADJ FUNJ. HAGME NSCFR VN.L. CHCT

Decrypt the ciphertext. 7. The key WHODONEIT was use to create the Playfair rectangle B A T I E

w H 0 D N

c F G J K

R Q

p M L

s u v X

! ?

y

z

:

and produce the ciphertext HOTOW DPIZA

What is the plaintext?

4.6

Unbreakable Ciphers

We can extend the idea of a shift cipher by using different shifts at different letter positions. Instead of choosing a shift s, we choose a vector of shifts = (s 1 , s2 , . . . , sk ) · Given plaintext x = (x 1 , x2 , . . . , Xk), the associated ciphertext Y = (y1 , y2 , . . . , yk ) is Yi = (xi + s i) mod 26 which can be expressed concisely as s

(y

= x + s ) mod 26

UNBREAKABLE CIPHERS

93

The vector s is called the key. If the key is as long as the plaintext, and if it used only once ( and is sufficiently random ) , then the ciphertext is essentially unbreakable. This is called a one-time pad. A friend with the same key can recover the plaintext by computing x = y - s mod 26

. < •

This scheme is occasionally used for highly sensitive documents. However, it requires the generation and distribution of potentially large numbers of keys. These keys are traditionally hand carried in diplomatic pouches to embassies around the world.

; , Example 4.22 If the plaintext C

is added to the the resulting ciphertext is HJWKT TWUQD CAHOB LQVGH AFW. For example, since T ---+ 19 and 0 ---+ 14, the first ciphertext character is given by 19 + 14 mod 26 = 7 ---+ H. key

THEBU YISGO INGDO WNA TN OON

OCSJZ VOCKP UNBLN PD VNU MRJ,

If the key is used more than once, then the first character of the key is subject to attack by a statistical analysis of the first letters being sent in the various ,; messages. This is similar to the way that simple shift ciphers are broken. The letters in the key are subject to the same attack. .. ,F other Most messages do not require absolute security. It is enough to make the •;, cost of reading the message higher than its potential value to the eavesdropper. :: An easy modification of the one-time pad is to create keys that are short enough )' to be remembered. This is idea behind the Vigenere cipher. >

•

Example 4.23 Using a key

plaintext

of length 5, it is possible to encipher the by adding the extended key OCSJZ to generate the ciphertext HJWKT MKKPN WPYMN KPSCM OCSJZ

THEBU YISGO INGDO WNA TN OON

OCSJZ OCSJZ OCSJZ OCS CQF.

How secure is such a system based on short keys? The problem is the same when you use a key more than once. Each message now becomes a sequence of messages each enciphered by the same key. as

' Problems 4.6 1. Use the one-time key SHORTCIPHERTEXTMESSAGES AREEXTREMELYHARDTOBREAK

to encrypt the message The longer the message the easier the decryption

using y = x + s mod 26 where x is the plaintext vector and s is the key vector.

94

CHAPTER 4. CIPHERS

2. The ciphertext LLGMV GEVGX VQMAZ KWASK WWUHT TSEMS NSNOX AFPSR I

was encrypted using the one-time key SECUREKEYEXCHANGEIS ESSENTIALFORONETIMEKEYS

Decrypt the message. 3. The short key MILLIONAIRE was used to produce the ciphertext IPZTA HUEEV EWMDE TWAK

Decrypt the message. 4. The short key PLAYFAIR was used to produce the ciphertext HSOPY KMPHN ALJAA ZAJBC WEKFV YIXJD

Decrypt the message. 5. The short key CODETALKER was use to generate the ciphertext YVBTE AJPEZ TKKIG TSOSK JSUKN YDKVV WGLRZ RDK

Decrypt the message. 6. A pseudo key of longer length can be generated by using two short keys. Thus the two keys CODE and ENCRYPT can be used as a two-stage cipher p + +

C E c

1 0 N i

a D C p

i E R h

n

C Y e

t

0 P r

t

e

x

D T t

E E

C N

e

x

0 c t

where the ith ciphertext character is the mod 26 sum of the three charac­ ters above it. What is the length of the pseudo key? 7. Encryption can also be done at the bit level. Given a byte (1, 0, 0, 0, 1 , 0, 1, 1) and a key (1, 1 , 0, 1 , 1, 0, 0, 1), the vector sum modulo 2 is given by (1, 0, 0, 0, 1, 0, 1, 1) + (1, 1, 0, 1, 1, 0, 0, 1) mod 2 = (0, 1 , 0, 1, 0, 0, 1 , 0) Show that decryption is the same as encryption.

ENIGMA MACHINE

95

Enigma Machine · The Enigma machine (see Figure 4. 1) is an electromechanical cipher device that was used by Germany during World War U. It was placed in submarines, ships, . and other locations to transmit and receive sensitive information. Mathematicians and cryptanalysts from Poland, Great Britain, and the United States were partially successful in breaking the Enigma ciphers, and the information gained was used to help the Allied war effort. The British and American efforts took place at Bletchley Park under the leadership of the British mathematician Alan Thring4 (1912- 1954) who is best known for his formulation of an abstract computational device now called a Thring machine. The following statement by the Bletchley Park Board of Trustees speaks to the significance of this operation. ·

Bletchley Park during the Second World War seethed with life, in­ tellectual stimulus, individuality and eccentricity. It was a hotbed of revolutionary thinking; ideas whose practical application in time of crisis preserved freedoms, saved lives and changed the way the world communicated. The work of Bletchley Park's pioneers secretly af. fected the fate of nations during the course of the war and helped shorten it by at least two years. Since then, millions of people have been influenced by what happened on and beyond this site. Bletchley Park Board of Trustees

The Enigma machine5 used a keyboard to enter plaintext. This keyboard was connected with wires and gears to light bulbs that indicated the corresponding ciphertext. The gears, or rotors, were configured much like automobile odome­ ters used to be, so that one rotor moved with each keystroke, and as it moved from position 25 to position 0, it forced the second rotor to move one notch. Each machine contained at least three rotors plus a fixed reflector (see Figure 4.1). The rotors could be removed and replaced in any order and in any initial position, so a great many variations were possible. The daily key consisted of the initial positions of the rotors. Each rotor was connected with a series of wires that created a permutation cipher. An electric charge from the keyboard would enter each rotor at one position, then the permutation would connect the charge to a different position on the far side of the rotor. The reflector rotor at the end was a fixed product of disjoint 2-cycles, say p = (0 12) (1 9) (2 3) ( 4 24) (5 18) (6 23) (7 8) (10 25) . (11 13) (14 21) (l 5 17) (16 19) (20 22) 4See http:/ fwww.turing.org.uk/turing/ for interesting detail about the life and contribu­ tions of Alan Turing. . 5See http:/ fwww.bletchleypark.org.uk for a history of Bletchley Park and the Enigma · machine.

CHAPTER 4. CIPHERS

96

Such a permutation has the property that xPP = x for each x , so that p2 the identity function. The rotor allowed the charge to travel back through the set of rotors to the keyboard, where one of the keys would be illuminated. The ciphertext character would be noted by the keyboard operator, and the resulting ciphertext would be transmitted by a radio operator. It is easier to describe the Enigma machine mathematically than it is to describe it physically. There are permutations 0" 1 , o-2 , and o-3 that correspond to the rotors. For each plain-text character x, a cipher-text character y is generated by =

t,

The kicker is that o- 1 changes each time a new character is typed in, o-2 changes occasionally, and once in a while o-3 also changes.

REFLECTOR

I I I ROTOR S

®®®®00®00 00000000 0 0 0 @ 0 0 0 0 (0 LIGHT BULBS

®6®®00®00 00000000 0 0 0 @ 0 0 0 0 (0 KEYBOARD

Enigma machine To keep track of what o- 1 does in a certain state, we introduce a shift variable for each rotor, so that s 1 , s2 , and s3 keep track of what the top of each rotor is marked. Instead of computing xu1 , we actually compute y (x + s1 mod 26)u1 then compute Figure 4.1

=

>7' · ENIGMA MACHINE

97

To compute the inverse of the function Y

= (x + 8 1 mod 26)"" 1

must solve for x in terms of y. Applying u ! 1 to both sides of the equation, 1 1 we get x + 8 1 mod 26 = y"" 1- or x = y""1- - 81 mod 26. The actual machines had a few additional complications. In particular, a was added when the machine was modified for military use. The plug­ board allows the user to pair up ten pairs of letters with ten plug-in wires. The of possible plugboard settings is 150, 738, 274, 937, 250 which greatly the difficulty of deciphering Enigma when you do not know the plug­ setting. _

uu.u•�·v•

n,.,.PRP

Algorithm 4.1 Enigma Code Do for i from 1 to 3 Set 8 ( i) = initial shift of rotor i Do for x from 0 to 25 Set e (i, x) = x""; Set d (i, e (i, x)) = x Loop Loop Do for x from 0 to 25 Set r (x) = xP Loop Do for k from to message length Set x = m k Do for i from 1 to 3 Set x = e (i, x + 8 (i) mod 26) Loop Set x = r (x) Do for i from 3 down to 1 Set x = d ( i , x) - 8 ( i) mod 26 Loop Print ASCII(x) Set j = 0 Do while j < 3 Set 8 (j) = 8 (j) + 1 mod 26 Loop until 8 (j) =j; 0 Loop

1

To use Algorithm 4.1, assume permutations u 1 , 0'2 , 0'3 , and p have been defined, and m k represents the number equivalent of the kth alphabet character either plaintext or ciphertext. The number e ( i, x) is the image of x under the

98

CHAPTER 4. CIPHERS

permutation ai and d (i , y) = x if and only if e (i, x ) y(fi -1

.

Example 4.24

=

y and hence d (i, y) =

For concreteness, let

a 1 = (0 15 7 8 19 23) (1 4 17 2) (3 13 25 5 21 12) (6 9 10 22 1 1 14 24 16 18 20) a2 = (0 5 9) (1 2 3 7 6 8 4) (10 11 12 15 18 13 14 16 19 17) (20 25 22 21 24 23) a3 = (0 10 20 3 13 23 7 17 5 15 25 1 1 1 21) (2 12 22 4 14 24 8 18 9 19 6 16) p = (0 12) (1 9) (2 3) ( 4 24) (5 18) (6 23) (7 8) (10 25) (11 13) (14 21) (15 17) . (16 19) (20 22) 8 1 = 24 8 2 = 10 83 = 5

We will use these initial settings to encipher the message Get your forces into position to attack. We take x = 6 - G and compute Next, we compute z by z = (y + 82 mod 26 t2 = (17 + 10 mod 26)a2 = 1a2 = 2

and compute w by The reflector p then yields u = (w ) P = 17P = 15 Now redefine z by

( - 83 mod 26) = 15aa

z = uaa 1

-1

- 5 mod 26 = 5 - 5 = 0

redefine y by y = ( z(f2 1 - 82 mod 26) = oaz 1 - 10 mod 26 = 9 - 10 mod 26 = 25 and redefine x by -1 x = (ya1 1 - 8 1 mod 26) = 25a 1 - 24 mod 26 = 13 - 24 mod 26 = 1 5

rJi\ 7> ENIGMA MACHINE

99

['�nd hence the first ciphertext character is 15

· constants:

�

P. Finally, we update the shift

8 1 := 8 1 + 1 mod 26 = 25 (If 8 1 = 0, then we would update 8 2 j if also 82 = 0, then we would update 8 3 .) Continuing in this way, we see that the ciphertext is PIIA Y BLBQH YTDXP XZIHU YKTQP DFCA V QET

as

One feature of Enigma is that the enciphering procedure is exactly the same the deciphering procedure. To see this, let J.L = , FERMAT'S LITTLE THEOREM

159

For over 350 years many as no solutions in positive integers x, y, and and amateur mathematicians tried to verify Fermat's statement, fessional ;��ro no one succeeded in proving it. The statement became known as "Fermat's but ' Theorem" because it was the last of, Fermat s claims that people figured Last how to prove. One of the remarkable achievements of the twentieth century out :was that Andrew Wiles (1953-) was able to prove it. z.

I grew up in Cambridge in England, and my love of mathematics dates from those early childhood days. I loved doing problems in school. I'd take them home and make up new ones of my own. But the best problem I ever found, I found in my local public library. I was just browsing through the section of math books and I found this one book, which was all about one particular problem-Fermat 's Last Theorem. This problem had been unsolved by mathematicians for 300 years. It looked so simple, and yet all the great mathematicians in history couldn't solve it. Here was a problem, that I, a ten year old, could understand and I knew from that moment that I would never let it go. I had to solve it. Andrew Wiles

Fermat's last theorem is also known as his great theorem. Our next result is sometimes called Fermat 's little theorem to distinguish it from his great theorem. It is also called simply Fermat 's theorem. The Chinese knew as early as 500 B.C. that 2P - 2 is divisible by the prime p. Fermat rediscovered this fact in 1640, and stated that he had a proof that if p is any prime and x is any integer not divisible by p, then xP - l - 1 is divisible by p. Euler published the first proof of Fermat's little theorem in 1736. Theorem 7. 7 {Fermat 's Little Theorem) If p is a prime and a j_ p, then

aP - l = 1 (modp) Proof. Assume that p is a prime and a j_ p. If na = ma (modp) then n = m (modp) , and hence it follows that no two of the numbers a, 2a, 3a, . . . , (p - 1 )a are congruent modulo p, and none is congruent to zero modulo p. It follows that these integers are congruent to 1, 2, 3, . . . , (p - 1) in some order so

(a) (2a) (3 a )

·

· ·

((p - 1)a) = 1 2 · 3 · · · (p - 1) (modp) ·

We can rewrite this as aP - 1 (p - 1) ! = (p - 1) ! (modp) But p j_ (p - 1) ! and hence aP - l = 1 (modp)

I

160

CHAPTER 7. THEOREMS OF FERMAT AND EULER

Corollary 7.8 If p is a prime and a is any integer, tl!,en aP = a (modp) . Proof. Given a prime p and an integer a, either a j_ p or else pia. If p j_ a then

aP - 1 = 1 modp by Fermat's little theorem. Multiplying both sides by a gives aP = a (mod p) On the other hand, if pia then, a = 0 (modp) so aP ::= OP = O = a (modp) I

Example 7.9 To verify Fermat's little theorem for p = 101 and a = 5, we perform the calculations shown in Table 7.2 and note that 5 1 00 mod 101 = 1 .

x2 mod 101 -+ x 5 2 mod 101 = 25 25 2 mod 101 = 19 192 mod 101 = 58 58 2 mod 101 = 31 31 2 mod 101 = 52 522 mod 101 = 78

le/2J

-+ e

L100/2J = 5o L50/2J = 25 L25/2J = 12 L12/2J = 6 L6/2J = 3 L3/2J = 1

e mod 2 0 0 1 0 0 1 1

prod · x mod 101 -+ prod 1 1 · 19 mod 101 = 19 19 · 52 mod 101 = 79 79 · 78 mod 101 = 1

Calculation of 5 1 00 mod 101 = 1

Table 7.2

What about the converse? If an = a (mod n) for every integer a, must be prime? The answer is no, and an example is provided by the integer n = 561 = 3 1 1 · 17. We now show why this is the case. The idea is to look modulo 3, 1 1 , and 17. Note that 560 = (3 - 1) . 280 = (11 - 1)56 = (17 - 1)35 so a2 = 1 (mod 3) and a 1 0 = 1 (mod ll) and a 1 6 = 1 (mod 17) by Fermat's little theorem. If a j_ 3, then n

·

a5 6 1 mod 3 = a · a5 60 mod 3 = a · (a2 ) 280 mod 3 = a · (1) 280 mod 3 = a mod 3

161

FERMAT'S LITTLE THEOREM · ;lind

if 3la, then a56 1 = 0 = a (mod 3) . Similarly, if a ..l 1 1 , then a5 6 1 mod 1 1 = a · a560 mod 11 = a · (a 1 0 ) 56 mod 1 1 = a · (1) 56 mod 1 1 = a mod 11

and if 1 1 l a, then a56 1 = 0 = a mod 1 1 . Finally, if a ..l 17 then a5 6 1 mod 17 = a a560 mod 17 = a · (a 1 6 ) 35 mod 17 = a · (1) 35 mod 17 = a mod 17 ·

and if 17la, then a5 6 1 = 0 = a mod 17. Thus for any integer a, we have a = a5 6 1 (mod 3) a = a56 1 (mod 11) a = a56 1 (mod 17) It follows from the Chinese remainder theorem that a5 6 1 = a (mod 561) for every integer a. Thus it is possible for an integer n to be composite even though an = a (mod n ) for every integer a. A composite integer n such that an = a mod n for every a is called a Carmichael number after Robert D. Carmichael (1879-1967) , who first con­ structed such a number in about 1909. The number 561 is the smallest Carmichael number. There are many others, some of which are given in the problems. Problems 7.3 1 . Verify Fermat's little theorem for a = 2 and the prime p Algorithm 7.2.

=

11, using

2. Let p be a prime such that gcd (p, a) = 1. Show directly that if aP = a (mod p) , then aP - 1 = 1 (modp) , thus deriving Fermat's theorem from its corollary. Is it necessary that p be a prime? 3. Let p be a prime such that gcd (p, a) = 1 . Show that if n mod (p - 1 ) = 1 , then an = 1 (modp) . In problems 4- 10, use Fermat ' s little theorem to find the answer. 4. 2 1 00 mod 13

162

CHAPTER 7. THEOREMS OF FERMAT AND EULER

5. 21 000 mod 13 6. 3 500 mod 17 7. 52000 mod 17 8. 72222 mod 23 9. 1 1 1 234 mod 29 10. 2 100 mod 3J. 1 1 . Verify that 52 1 7 mod 217 = 5. Factor 217. 12. Verify that

x 11 05

=

x (mod 1105)

for every integer x. Show that 1105 can be written as a sum of two squares in four different ways. (Integers smaller than 1105 can be so written in at most three ways.) 13. Verify that 1729 is a Carmichael number. Verify that 1729 is the small­ est positive integer that can be written as the sum of two cubes in two different ways. This is the famous Hardy-Ramanujan number, so called because of the conversation between those two mathematicians af­ ter Hardy took a cab numbered 1729 to visit Ramanujan in the hospital. See http: I I en.wikipedia.orglwikil1729_(number) . 14. Verify that n = 6601 is a Carmichael number. 15. Prove that a product n of distinct primes is a Carmichael number if n is composite and n 1 is divisible by p 1 for each prime p dividing n. -

-

16. Let k > 0 and assume 6k + 1, 12k + 1 , and 18k + 1 are all primes. Show that n = (6k + 1) (12k + 1) (18k + 1) is a Carmichael number. 17. Use the result of Problem 16 to construct eight Carmichael numbers of the form n = (6k + 1) (12k + 1) (18k + 1) where 1 :::; k :::; 100.

RABIN'S PROBABILISTIC PRIMALITY TEST

163

Rabin's Probabilistic Primality Test number is prime if its only positive divisors are 1 and itself. Thus to prove that 7 is prime we have to show that none of ' the numbers 2, 3, 4, 5, 6 divides 7. This search can be shortened a bit by only testing numbers a such that a :::; v'7. . This works because if 7 = ab, and a > v'7, then b = 7/ a < v'7 and 7 is also divisible by b . Thus 7 is prime because 2 does not divide 7. That ' s a pretty good test for small primes p, but what if p is a hundred . digits long? Testing p in this manner for primality requires testing all integers a in the range •

which is, essentially, an impossible task. A related question is how to generate all the primes up to a certain number n. One way to do that is to go through all the numbers from 2 to n and test each one to see if it ' s a prime. That's not too efficient. Another approach is the sieve of Eratosthenes (third century B.C.). The idea there is that if you remove the composites, then everything that remains will be prime. Algorithm 7.3 Sieve of Eratosthenes Input: Positive integer m Output: All primes up to m Initialize p(k) = 0 for k from 1 to m Set p (1) = 1 Set q = 2 For r = q 2 to m step q Set p(r) = 1 End For Set q = 3 While q 2 :::; m do For r = q2 to m step 2q Set p (r) = 1 End For Repeat Set q = q + 2 Until p (q) = 0 End While For r = 1 to m If p (r) = 0 then print r End For End

Start with the set {2, 3, . . . , n} , and cross out the proper multiples of 2, which are 4, 6, 8, . . . . Then cross out the proper odd multiples of 3, which are 9, 15, 2 1 , . . . . The number 4 and all its multiples are already crossed out, so we

164

CHAPTER 7. THEOREMS OF FERMAT AND EULER

next cross out the odd multiples of 5, starting with 25, which are 25, 35 , 45, . . . , the odd multiples of 7 starting with 49, and so on until we exceed fo at which point we stop. The sieve of Eratosthenes is implemented by Algorithm 7.3. The primes less than 100 are listed in Table 7.3. We start by crossing out 0 and 1 , then the multiples of 2 starting with 4, then the odd multiples of 3 starting with 9, then the odd multiples of 5 starting with 25, then the odd multiples of 7 starting with 49. The remaining numbers are all primes. 2 -{} -l -w 1 1 -!2 -29 -u � -3fl 31 -32 -49 41 -42 -W M -&2 -6(:} 61 -62 !ffl 71 -12 -8{} -8± -82 -oo 91 -92

--4 -l4 M -33 -34 43 -44 53 M -63 -64 73 -74 83 -84 -93 -94

7 --8 ---9 ---{) -M 17 -±8 19 � .'};{ � 29 -36 37 -38 -39 46 47 48 49 -w -&-7 -68 59 {ffl 67 -68 -69 -'76 77 -78 79 -86 .sf -88 89 -96 97 -98 -99

5

3 13 23

-l-6 � -3{; 46 -&f) -% -1-15 .8tJ -%

Primes less than 100

Table 7.3

Figure 7. 1 is a picture of the primes less than 10 000, generated by the sieve of Eratosthenes. ' ! : :! : : I : I : : : ! � : : ' 1 1 ' ' I , : 1 1 ' • ,I� I .• : ··:· . : · .·

:i:. ·. : . : � ··, : . . . . 1 . . .. · . . � I:1 : ; 'I : ! J � .

1

•: I '' I i,: ! . . ! ;: I. 1: : =:: . : · = o;:'

I

I

I' • " l • ,1 I' •' ' . :. : : :�: ·.: ;I : ,;,• : i1 : : : I, I' I : •! • ,',, I i' I : : : • II�: •I � " I = � , �:': • 1 : : � 1 , •: I : •: II ; 1 ;. , : •i ···: i: l ••

1

o

'•

,

1

1

•

"•

•

•

.

·

Figure 7.1

' ,!••

::.:

'' :: I :

!

; •

,•,

:,•:

: :: i I

I

•

•

ii1' 1,•

: i I : ::: : • i 1 :1 , :•· .·• ; .· ·� · � :. .. .. � .! i: :': I :: : :: i : �:

:•=! •: 1 : : : • , : : 1 : .. j II • ' . . . •.!• �-. �. , .·,.· .� .: ;. .: : · : = I , •: : II : ; : • ' : , , : �: :' : : : : :· 1'!: •• I,, I1 • , 1 1 •1 'I '• '• · . ! ••: ::= : : : .: : . : !

.

·

.

·

1

.

.

•

•.

:,, ' I ' , · .:: ,! ! , :•:; :• I � 1 1 : , ; j • : ; � • i : ! :; I• ' ' ! • •I •! I ,, 1 :i i I •" •; . : I ; :: • • •• • : • : •:; : i ' '• • I : , ' •I : :: , ' • 1 • : I : , • ·= 1 • 1 ' :··. · · ·. !· ,

•

,•

'

1

•

,

•

.

Primes

I , then ai = af_ 1 = am = a�_ 1 , contrary to the minimality of m. Consider the permutation ( a 1 a2 am ) - 1 a = T . Note that a'[ = ai for i = I . m and xu = xt for all other x E { I , 2, . . , n} . Thus T moves fewer than k integers and hence T is a product of disjoint cycles. Thus a = ( a 1 a2 · · · am ) T is also a product of disjoint cycles. ·

.

·

.

�

PY

�

·

.

Problems 4.4

I . IS

·

.

( � ! ) mod 26 24 ) ( � ! ) mod 26

( 8 I8 ) (

I5

=

( 2 IO )

=

�

( 20 9 )

CK

�

UJ

3. MC TX BX HN FZ IY AN TI OH WN BC PD RT XN SV DH DV IE ZW IR MP CV QB RF IY PB VO VR JN YM IN KA IG KT WC RS AH CL YO KS UD OQ DY KM BH HX IC CJ OU RS HN KU

5.

x U �r (�� The inverse cipher is 7 8 7 I 6

3 I 3 7 9

6 9 4 9 3

mod 26 � X

II I2 I6 19 I5 II I I I4 5 I3 I7 0 24 I9 23 I I I 3 I2 I 5

�

l

mod 26

340

SOLUTIONS TO ODD PROBLEMS

7. Assuming the fictitious Social Security number is 555-55-5555, the affine transformation yields the encryption 5 0 3 8 6 5 9 8 5 . See the solution on the disc for details. 9. The plaintext is If sensitive data falls into the wrong hands, it can lead to fraud or identity theft.

See the solution on the disc for details. Problems 4.5

1. The Playfair square is given by c I R s p E A K H u G N B F 0 v D Q T y The plaintext and ciphertext are given by WH EA TS TO NE NA !

!

L M w X z

ME DT J

HE

PL

!

!

HU

AK YR

!

!

RT

UK

GK

PA

QY UP

MC

AY

FA

IR

CI

PH

ER

AF

TE

RH

IS

KT

OE

RS

IR

HB

AI

EO

QA

OI

RL

FR

EI

ND

LY

ON

PL

AY

FA

IR

OI

UE

HY

sz

VG

MC

KT

OE

RS

!

!

!

J

!

J

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

J

3. Use the Playfair square

to obtain the message

R H E 0 s D c B A T F G IJ K L u Q p N M v w X y z

The primary use of a Wheatstone bridge is the measurement of resistance.

5. The Playfair cipher may be improved by seriating its input text. 7. Who ? Not mel

PROBLEMS 4. 7

341

Problems 4.6 1. LOSCH POTYX YXQBL EEYWT NIWAJ MIOMY IPINP PPKLH B

3. Who is the weakest link ? 5. Why Playfair (play fair?) when the other guys are using RSA ? 7. Since 1 + 1 mod 2 = 0, it follows that adding the same binary vector twice gives back the original vector. In particular, if 1 0 0 0 1 0 1 1 ) + ( 1 1 0 1 1 0 0 1 ) mod 2 =( 0 1 0 1 0 0 1 0 )

(

then 0 1 0 1 0 0 1 0 ) + ( 1 1 0 1 1 0 0 1 ) mod 2 =( 1 0 0 0 1 0 1 1 )

(

Problems 4. 7 1 . We take x = 7

and compute y = ( x + s 1 mod 26)a 1 = (7 + 25 mod 26t 1 = 6a 1 = 9 z = (y + s2 mod 26t2 = (9 + 13 mod 26t2 = 22a2 21 = (z + S 3 mod 26)a3 = (21 + 4 mod 26t3 = 25aa = 1 u = (w)P = 1P = 9 z = ua3 1 - s3 mod 26 = 9a3 1 - 4 mod 26 = 18 - 4 mod 26 = 14 y = (za2 1 - s 2 mod 26) = 14a2 1 - 13 mod 26 = 13 - 13 mod 26 0 -1 -1 X = (ya1 - 8 3 mod 26) = 0a1 - 25 mod 26 = 23 - 25 mod 26 = 24 t-

'H'

=

W

(

)

=

and hence the first ciphertext character is 24 the shift constants:

-+

'Y'. Finally, we update

8 1 - s 1 + 1 mod 26 = 0 82 - 82 + 1 mod 26 = 14 Continuing in this way, we see that the ciphertext is YQ. 3. Attack now!

.

( 26) (24 2 ) . . m In the example there are (26 ) ways 5 . The number is 2 2 ) e2 2 10! ' to choose the first pair {A, Z}, then e24) ways to choose the second pair {B, Y}, and so on. But the 10! ways of listing these 10 pairs all give the same pairings, so we must divide by 10! to get the number of distinct plugboard settings.

.

342

SOLUTIONS TO ODD PROBLEMS

( 61

2 3 4 5 6 7 7 2 5 3 1 4

) and - 1 - ( 21

)

2 3 4 5 6 7 3 7 1 5 4 6 9. Let p = (at , a2 , , ak ) and set r = 0"- 1 • Then (ai) upr = (ai r upr ( a1 ) . ( ai+1 ) £or · 1 , 2 , . . . , k - 1 , and (akr ) upr ( ak ) rupr apr apr k i xr so x r is fixed by the If x � {a1 , a2 , . . . , ak } , then xrupr = xPr permutation O"pr. Thus O"pr = (ai , a2 , . . . , ak) is also a k-cycle.

7 · O" -1 =

•

=

'T

•

r

.

=

z =

=

=

=

'T

=

Chapter 5

Error-Control Codes

Problems 5 . 1 1 . The probability of getting 10 out o f 1 0 on a true false exam is ( �) 10 1 0�4 9. 765 6 x 10- 4 . 3. The codewords 000 and 1 1 1 are a distance 3 apart. 5. There are 200 places where the error could occur; so the probability of a single error is e�0) (1 - 0.0001/ 9 9 (0.0001) = 1 . 960 6 X 10 - 2 • 7. The expected number of errors is the sum of n x ( the probability of exactly n errors ) , which is given by 1000 (1 - 0 . 001/ 000 - n (0.001t = 1.0 nX =

�

�

c�O)

The contribution by the nth bit is 1 x (0.001) = 0.001 . Since there are 1000 bits, the expected number of bit errors is 1000 x (0.001) = 1.0. 9. If the probability of a letter being changed is 1/10, then you can expect about a tenth of the letters to be changed. For two consecutive sentences, about one fifth of the letters can be expected to be different. The length of the sentence is 65, and 65/5 13, so on average the distance between two sentences should be roughly 13. Indeed, the distances between pairs of sentences range from 1 1 to 14, so an average of 13 is reasonable. =

Problems 5.2 l.

ll l l l ll l i l l l li l l il ll ( 2001 ) 5 =wnwnn

3.

7=nnnww

ifi1l dil l I mu I3=wwnnn I IIII 7=nnnww �

.._,._....

( 5773 )

( Note that the short bars were added to indicate the width of beginning and ending spaces. )

343

PROBLEMS 5.3

9

,.....,.__

1

,.....,.__

2

1

,.....,.__

,.....,.__

5. The 2 of 5 bar code IIIII IIIII IIIII as (9112001; September 11, 2001 ) 7, The Code 39 bar code C

0

IIIII

0

,.....,.__

IIIII

E

D

0

,.....,.__

IIIII

1

,.....,.__

IIIII decodes

3

9

iinl lflll U ifill fil ifiTJ U

decodes

as

( Code 39) .

9. The Interleaved 2 of 5 bar code

5=wnwnn

1=wwnnn

II I II II I5=wnwnn II III I III I 8=wnnwn I III II -----

......

start

-----

'--v---'

6=nwwnn

�

end

III I II II III II2=nwnnw

,.....,.__

__......._

"-..---'

decodes as (551862; Cinco de Mayo) .

( Note that the short bars were added to indicate the width of beginning and ending spaces. )

1 1 . The Code 39 bar code

l l i ll

2 8 11 111 11 111

I If II llfl l IIII I IIi II IIII I III II III II III II IIII I I IIII r

f

e

c

t

*

decodes as 28 is perfect. (A perfect number is a number that is equal to the sum of its proper divisors. In this case, 1 + 2 + 4 + 7 + 14 28.) =

Problems 5.3

1.

0

3

7

0

0

0

...... ...... ...... ...... ......

6 2 8 1 1 8

...... ...... ...... ...... ...... ......

344

SOLUTIONS TO ODD PROBLEMS

10

L iai i= l

mod 1 1 = 0

Assume that ak and an are interchanged, ak =/:- an , and 1 S k < n Set bk = an, bn = ak , and otherwise bi = ai . Then

t, ibi mod

11

= = =

=

(t,

ibi -

t, iai) mod

S

9.

11

(k (bk - ak) + n (bn - an)) mod 1 1 (k (an - ak) + n (ak - an) ) mod 1 1 (k - n) (an - ak) mod 1 1 =/:- 0

because 1 1 divides neither of the factors k - n or an - ak . ( Why? ) Thus cannot be a valid ISBN number.

� I I r � II � (Ill �' � II � � Il l)' � II �' � II�' � � � � , �� ��, (I l l � " 0

0

5·

7. The first digit (0) represents the country and the second part represents the publisher. The last digit is the check sum

0 1 + 4 2 + 7 3 + 1 4 + 8 · 5 + 9 6 + 6 7 + 1 8 + 4 9 mod 1 1 ·

·

·

·

·

·

9. Do a web search on a bar code such as code 93. 11.

A short element could be added to any of

There are �

=

60 rearrangements of

5! - 10 rearrangements of

3121

·

·

=

4

PROBLEMS 5.4

and 2f�1

=

345

{j, l . 1 . u} {1 . 1 · 1 ' 1 · 1 }

30 rearrangements of

for a total of 60 + 10 + 30

=

100 symbols.

Problems 5.4

In the following problems,

H

D

=

=

u

1 0 1 1

1 0 0 0

0 1 1 1

0 0 1 0 0 0 0

0 0 0 0 1 0 0

0 0 0 0 0 1 0

0 0 0 0 0 0 1

0 1 0 0

0 0 1 0

P n. �

0 0 0 1 1 1 1

0 1 1 0 0 1 1

1 0 1 0 1 0 1

, and

1 . The codeword is ( 1 0 1 1 ) H mod 2 = ( 0 1 1 0 0 1 1 )

P

3. The parity is even, so we assume there are either 0 or 2 errors. An error check yields ( 1 0 1 1 0 1 0 ) mod 2 ( 0 0 0 ) which indicates no errors, so the plaintext is given by ( 1 0 1 1 0 1 0 ) D mod 2 ( 1 0 1 0 )

P

=

=

5. The parity is odd, so we assume a single error occurred. An error check yields ( 1 0 1 1 0 1 0 ) mod 2 = ( 0 0 0 ) so we assume the error occurred in the 8th bit. The plaintext is given by ( 1 0 1 1 0 1 0 ) D mod 2 ( 1 0 1 0 ) =

346 7.

SOLUTIONS TO ODD PROBLEMS

The codewords are given by

I ll = ( 0 1 0 1 0 1 o ) = ll I =( 1 0 0 0 0 1 1 )= II =( 1 0 0 1 1 0 o)= II =(0 1 0 0 1 0 1 )= l I =( 1 1 0 0 1 1 o) II =(0 0 0 1 1 1 1 )= I =( 1 1 1 0 0 0 0)= 1 ( 0 0 1 1 0 0 1 )= II =( 1 0 1 1 0 1 o)= l Il =(0 1 1 0 0 1 1 )= II =(0 1 1 1 1 0 0)= I =( 1 0 1 0 1 0 1 )= 1 11 =(0 0 1 0 1 1 o)= II

( 0 0 0 1 ) H mod 2 = ( 1 1 0 1 0 0 1 ) = ( 0 0 1 0 ) H mod 2 ( 0 0 1 1 ) H mod 2 ( 0 1 0 0 ) H mod 2 ( 0 1 0 1 ) H mod 2 ( 0 1 1 0 ) H mod 2 ( 0 1 1 1 ) H mod 2 ( 1 0 0 0 ) H mod 2

=

( 1 0 0 1 ) H mod 2 = ( 1 0 1 0 ) H mod 2 ( 1 0 1 1 ) H mod 2 ( 1 1 0 0 ) H mod 2 ( 1 1 0 1 ) H mod 2 ( 1 1 1 0 ) H mod 2

Omitting patterns with 1 or 4 bars, there are 10 remaining two- and three-bar codes that could be used to encode the digits 0-9. This bar code symbology would give single error correction.

PROBLEMS 6. 1

347

9. An error check yields

( 0 0 0 0 0 1 1 ) P mod 2 = ( 0 1 1 )

' which indicates an error in hit ( 0 1 1

(0 0 1 0 0 1 1 )

11 .

0 0 1 0 0 0 0

0 0 0 0 1 0 0

0 0 0 0 0 1 0

) 2 = 3. 0 0 0 0 0 0 1

Thus

mod 2 = ( 1 0 1 1

)

The parity is even, so we assume there are either 0 or 2 errors. An error check yields

( 0 1 0 0 1 0 1 ) P mod 2 = ( 0 0 0 ) so assume there are no errors. Thus the plaintext is

( 0 1 0 0 1 0 1 ) D mod 2 = ( 0 1 0 1 ) 13. The parity is odd, so we assume a single error occurred. An error check yields ( 1 1 1 1 1 1 1 ) P mod 2 = ( 0 0 0 ) so a single error must have occurred at bit 8. The plaintext is 1 1 1 1 1 1 1 ) D mod 2 = ( 1 1 1 1

Chapter 6

)

Chinese Remainder Theorem

Problems 6 . 1

1. Both equations are satisfied by x = 3 and y = 4 ; that is, 2·3+3 · 4 mod 1 1 = 7 and 3 3 + 4 mod 1 1 = 2. See the disc for details of the solution. ·

3. Use row reduction to get 5 1 8 0 and conclude that

(. 43 85 ) - l = (

2 -1

� 4 -3

)

348

SOLUTIONS TO ODD PROBLEMS

( 3 5 ) -1 mod 1 1 = ( 2

Reduce modulo 1 1 to get

�) Check your answer by showing that ( ! ; ) ( 2 ) mod 11 = ( � ) 10 � � 10

4 8

See the disc for further details. 5. Note that

0 ir -1 ( ) 3 1 7

=

( ��

Reduce each entry modulo 17 to get 2 3 1 0 1 5 3 7 2

mod 17 =

7 1 - 24 - 12 - 24 152 5 24 - 1 2

1

(

1

)

12 12 15 10 12 16 15 8 7

)

See the disc for further details.

7. The answer is x = 1 , y = 12, and solution.

z

= 3. See the disc for details of the

9. A computer algebra system gives the solution 121 139 w = 2 , x = -89, y = 2 , z = -18 Reduce modulo 91 to find the solution 1 �1 mod 91 = 15, -89 mod 91 = 2, 1 �9 mod 91 = 24, and -18 mod 91 = 73. See the disc for further details. Problems 6.2

1 . The solutions to the congruence x = 5 (mod 9) are . . . , 5, 14, 23, 32, 41 , 50, 59, 68, 77, 86, 94, . . . and the solutions of x = 4 (mod 11) are . . . , 4, 15, 26, 37, 48, 59, 70, 81, 92, 103, 114, . and hence the common solutions are 59 + 99k for k E Z. .

.

3. There should be a unique solution x such that 0 :::; x < 3 4 5 = 60. The solutions in the interval 0 :::; x < 60 to three congruences are ·

·

A = {2, 5, 8, 1 1 , 14, 17, 20, 23, 26, 29, 32, 35, 38, 41, 44, 47, 50, 53, 56, 59} = {3, 7, 1 1 , 15, 19, 23, 27, 31, 35, 39, 43, 47, 51, 55, 59} (7 = {4, 9, 14, 19, 24, 29, 34, 39, 44, 49, 54, 59}

B

Note that A n B n (7 = {59}.

PROBLEMS 6.3

349

5. The Chinese remainder algorithm yields 353. 7. The Chinese remainder algorithm yields 419. 9. The congruence 2x + 3 = 7 (mod 1 l) is equivalent to 2x = 7 - 3 = 4 (mod 1 1 ) , and hence x = 4 · 2 - 1 = 2 (mod 11 ) . The congruence 3x + 4 = 5 (mod 13 ) is equivalent to 3x = 5 - 4 = 1 (mod 13 ) , and hence x = 3 - 1 = 9 (mod 13 ) . Thus the original pair of congruences is equivalent to the system x = 2 (mod 11 ) and x = 9 (mod 13 ) . Thus x must satisfy x = 2 + 11k 9 + 13r 1 1k = 9 - 2 (mod 13 ) k = 7 . 11 - 1 mod 13 3 =

=

so x = 2 + 1 1 · 3 = 35 (mod 143 ) . Checking, note that 2 · 35 + 3 mod 1 1 = 7 and 3 · 35 + 4 mod 13 5. =

Problems 6.3

1 . The product is 37759097376· 1 16389305648 = 4394 755 125 487 858 779 648. See the disc for details of the computation using base b 1000 arithmetic. =

3. The product is 37759097376· 1 16389305648 4394 755 125 487 858 779 648. See the disc for details of the computation using the modular basis ( 997, 999, 1000, 1001, 1003, 1007, 1009, 1013 ) and the Chinese remainder algo­ rithm. 5. We have 240 1 .099 511 628 x 10 1 2 • Modulo 1000, we have 240 mod 1000 2 1 0 x 2 1 0 x 2 1 0 x 2 1 0 mod 1000 24 x 24 x 24 x 24 mod 1000 776. Modulo 100 000, have 2 40 mod 100 000 2 1 0 x 2 1 0 x 2 1 0 x 2 1 0 mod 100 000 · · = 27 776, and hence the last five digits are 27 776. It follows that 240 1099 511 627 776. See the disc for more detail. 7. Because 100! = 2 97 348 5 24 7 1 6 11 9 13 7 17519 5 234 293 31 3 372 41 2 43 2 472 53 x 59 x 61 x 67 x 71 x 73 x 79 x 83 x 89 x 97, the modular representation is =

�

=

=

=

=

=

·

=

100! = (O, O, O, O, O, O, O, O, O, O, O, O, O, O, O, O, O, O, O, O, O, O, O, O, O) Note that the elements of the modular basis are all powers of distinct primes, and are thus pairwise relatively prime. Problems 6.4

1 . Note that 2x 3 + 3x2 + 3x + 1 = ( 2x + 1 ) ( x2 + x + 1 ) and 2x2 + 5x + 2 ( 2x + 1 ) (x + 2 ) , so gcd ( 2x3 + 3x2 + 3x + 1, 2x2 + 5x + 2 ) 2x + 1 . =

=

350

SOL UTIONS TO ODD PROBLEMS

3. Modulo 5 we have 6x + 3 2x3 + 3x2 + 3x + 1 = x 1+ 2 2x2 + 5x + 2 2x + 5x + 2 2x3 + 3x2 + 3x + 1 = (x + 4) (2x2 + 5x + 2) + x + 3 2x2 + 5x + 2 2x 1 x+3 and modulo 7 we have 6x + 3 2x3 + 3x2 + 3x + 1 = x 1+ 2 2x2 + 5x + 2 2x + 5x + 2 2x3 + 3x2 + 3x + 1 = (x + 6) (2x2 + 5x + 2) + 6x + 3 2 2x2 + 5x + 2 1 = x+ 6x + 3 3 3 The leading coefficient must be 1 or 2. If the leading coefficient is 1, then modulo 5 we have x + 3 and modulo 7 we have 6- 1 (6x + 3) mod 7 = x + 4 and x + 18 does not divide 2x3 + 3x 2 + 3x + 1 . Assume the leading coefficient is 2. Then modulo 5 we have 2 (x + 3) = 2x + 1 , and modulo 2 + 3x+l - x 2 + x + 1 and 7 we have 2 (x + 4) - 2x + 1 Note that 2x3+23xx+l 2x 2 +x+l 5x+2 - x + 2 so 2x + 1 is a common divisor ' 2 ' 5. The greatest common divisor is 1 + 2x2 • As a check, note that 6x5 - 7x3 + 8x2 - 5x + 4 - 3 3x 5x + 4 2x2 + 1 8x4 + 6x3 + 8x2 + 3x + 2 - 4x 2 + 3 x + 2 2x2 + 1 See the disc for details of the polynomial division. _

_

=

_

·

_

_

_

7. Scientific Notebook produces gcd ( 6x5 - 7x3 + 8x2 - 5x + 4, 8x4 + 6x3 + 8x2 + 3x + 2)

=

1 + 2x2

9. Use long division to get 6x6 + 4x5 + 9x4 + 19x3 + 2x2 + 15x + 5 = 2 X 3 + 3X + 1 ::-- --::3x3 + 2x2 + 5 12x5 + llx4 + l lx3 + 26x2 + 5x + 15 - 4x 2 + x + 3 3x3 + 2x2 + 5 which shows 3x3 + 2x 2 + 5 is a common divisor. Note that 2.t':2�3;'tl = x+ lf ¥ implies 2x 3 + 3x + 1 = ( l x - l ) (4x 2 + x + 3) + 1 3 x + l! l2 x - l8 + 4x2+x+ 8 8 8 3 2 2 3 - 32 x - 248 + ( 848 ) wh ' h · d 1ca 3 + 3x + 1 ' t th t 2 es a x and 4x11! x++x+ .ll 13 1 69 1 69 -sx+s 8 8 and 4x2 + x + 3 are relatively prime. ------

-

------

_

_

13

11

IC

m

351

PROBLEMS 6.5

Problems 6.5 1 . See the answer to problem 3. See the disc for details of the solution using elementary row operations and rational arithmetic.

3. Direct calculation with a computer algebra system yields 240 16 - 120 1 21 31 41 - 1 1 1 1 1 -120 1200 -2700 5 2 4 3 = 1 1 1 1 240 -2700 6480 4 5 6 3 1 1 1 1 -140 1680 -4200 5

4

6

7

-140 1680 -4200 2800

5. Note that 1 1 12 2 2 3 1 1 det H3 = 2160 24335 1 1 det H4 = 6048 000 2 8 33537 1 1 det 5 = 1 0 2 355 000 800 5 73 H 266 716 1 1 = det H6 = 1 4395 2 000 200 339 420 313 186 5 75 11

det H2

=

=

=

7. The row operations

coo29

31 1 9 0

n�G �G

�) �)

1 1 1300 1 00 9 29 0 2 1 1 1300 1 00 1 -29 1 0

�

(� G

�

1) )

1 1 1300 1 00 1 1 2900 - 1 00 0 9 -31 1 -29 100

) ( 10029 319 ) -1 ( -299 -31 100 . -24 ) = 1 . Modulo 1 1 , the inverse is 9. Note that mdeed det ( _127 37 7 (� �) , and modulo 13, the inverse is (t71 ��) . The Chinese remainder theorem yields 127 -24 ) - 1 - ( c ([7, 7) , [11, 13)) c ([2, 1 1) , [11, 13)) ) ( -37 c ([4, 1 1) , [1 1 , 13)) c ([6, 10) , [11 , 13)) 7 - ( 7 24 ) 37 127 . giVe

=

.

SOLUTIONS TO ODD PROBLEMS

352 Checking, note that

Chapter

( ��� -:4 ) ( ;7 122� ) = ( � � )

7

Theorems of Fermat and Euler

Problems 7.1

1. Note that (101 - 1)! mod 101 100 = -1 (mod 101), (103 - 1)! mod 103 102 = -1 (mod 103), (105 - 1)! mod 105 = 0, (107 - 1) ! mod 107 106 = -1 (mod 107) , and (109 - 1)! mod 109 108 = - 1 (mod 109), so 101, 103, 107, and 109 are primes and 105 is not. 3. 1 2 mod 1 1 1 2 2 mod 1 1 = 4 2 3 mod 1 1 9 42 mod 1 1 5 5 2 mod 1 1 3 6 2 mod 1 1 = 3 72 mod 1 1 5 82 mod 1 1 9 92 mod 1 1 = 4 10 2 mod 1 1 1 5. Computing x2 mod 15 for x 1, 2, 3, ... , 14 shows that the solutions are 1 2 mod 15 = 4 2 mod 15 1 1 2 mod 15 = 142 mod 15 = 1 =

=

=

=

=

=

=

=

=

= =

=

=

7. We know that (p - 1 ) ! mod p = p - 1. Since p - 1 j_ p, it follows that (p - 2)! mod p 1 . Since p.- 2 (mod p) = -2, it follows that 1 (p - 3)! (p - 2) mod p -2 (p - 3) ! modp = 1 2 (p - 3) ! mod p p - 1. =

=

9. Rearrange the product as 2 3 4 5 · 6 · 7 8 · 9 · 1 0 · 1 1 · 12 · 1 3 14 · 15 = (2 9) · (3 6) (4 · 13) · (5 7) · (8 · 15) ( 10 12) (11 14) and observe that 2 9 mod 17 1, 3 6 mod 17 1 , 4 · 13 mod 17 1, 5 · 7 mod 17 = 1, 8 · 15 mod 17 1, 10 · 12 mod 17 = 1 , and 11 · 14 mod 17 1 . Hence 16! mod 17 = 1 · 16 · (2 9) · (3 6) · (4 · 13) (5 · 7) (8 15) · (10 · 12) · (11 14) mod 17 1 · 16 · 1 · 1 · 1 · 1 · 1 · 1 · 1 mod 17 16 mod 17 = -1 (mod 17) ·

·

·

·

·

·

·

·

=

·

·

·

·

·

·

·

=

=

=

=

·

·

·

·

·

·

=

=

Problems 7.2

k 1 . Using Algorithm 7.1 , gets 1 2 3 4

p 1 1 · 1 1 mod 15 1 1 1 1 1 1 mod 15 1 1 · 1 1 mod 15 = 1 1 11 · 1 1 mod 15 = 1 =

·

=

PROBLEMS 7.3

353

k

p

1 1 · 16 mod 29 16 so 164 mod 29 16 · 16 mod 29 = 24 24 · 16 mod 29 = 7 7 · 16 mod 29 = 25

3. Using Algorithm 7. 1 , gets 21 3 4

=

5. Using Algorithm 7.2, we get 5 97 mod 127 7. Using Algorithm 7.2, we get 46 3 mod 127

=

25.

=

80. See the disc for details.

=

1. See the disc for details.

9. We get 12 72 38789433936 3242 mod 243682743764

=

17 298 641 040.

1 1 . The second variation computes xn and then reduces the result modulo m . For x and n integers, xri is feasible to calculate exactly only if x and n are relatively small integers, say at most 3 or 4 digits each. The first variation makes it easy to calculate xn mod m for numbers x, n, and m that are each perhaps a hundred decimal digits long.

Problems 7.3 x n mod 2 ln/2J ----* n 1. x2 mod 11 10 0 2 1 2 2 mod l l 4 l10/2J 5 4 2 mod l l 5 l5/2J 2 0 l2/2J 1 1 5 2 mod l l 3 and we see that 2 10 mod 11 1 . 3. 2 1000 mod 13 ( 2 1 2 ) 83 2 4 mod 13 1 83 24 mod 13

p · x mod 11

-----*

=

1 1 · 4 mod ll = 4

=

=

=

=

=

-----*

p

3 4 mod l l = 1 ·

=

=

=

5. 5 2000 mod 17

=

7. 11 1 2 34 mod 29 9. 52 1 7 mod 217

(5 1 6 ) 1 2 5 mod 17

=

=

=

=

16 mod 13 = 3

1 1 25 mod 17 = 1

(11 28 ) 44 1 1 2 mod 29

5 although 217

=

=

1 44 11 2 mod 29

=

121 mod 29 = 5

7 x 31

1 1 . To verify this by hand, write 217 as a sum of powers of 2: 217

=

128 + 64 + 16 + 8 + 1 28 + 2 7 + 24 + 2 3 + 1

then compute 5 n (mod 217) for n 1, 2, 2 2 ' 2 3 . . ' 2 8 using the fact that each number 5 n (mod 217) is the square of the preceding one: =

'

.

5, 25, 191, 125, 191, 125, 191, 125, 191

354

SOLUTIONS TO ODD PROBLEMS

Finally, compute 5217

5 128 + 64+ 1 6 + 8+1 5 1 2 8 5 64 5 1 6 5 8 5 191 125 191 125 5 (mod 217) 5 (mod 217) ·

·

·

·

Trying to divide 217 by 3, 5, 7, 1 1 , . . . results quickly in 217 = 7 X 31 13. Note that 1729 = 7 x 13 x 19 and 1728 2 6 33. Since 7, 13, and 19 are primes, it follows that x 7 mod 7 x mod 7 and x 1 3 mod 13 = x mod 13 and x 1 9 mod 19 = x mod 19 for every integer x. Suppose x l. 7, x ..L 13, and x ..L 19. Then x 1 72 8 mod 7 = (x6 ) 288 mod 7 = 1 288 mod 7 = 1 x 1 728 mod 13 = (x 12 ) 144 mod 13 = 1 1 44 mod 13 = 1 x 1 728 mod 19 = (x 1 8 ) 96 mod 19 = 1 96 mod 19 = 1 =

=

and hence by the Chinese remainder theorem, x 1 728 mod 1729 = 1, which means that x 1729 mod 1729 = x mod 1729. Suppose that x mod 7 � 0, x l. 23, and x l. 41. Then x 1 729 mod 7 = 0 = x mod 7 x 1 728 mod 13 (x 1 2 ) 144 mod 13 = 1 1 44 mod 13 = 1 x 1 728 mod 19 = (x 1 8 ) 96 mod 19 = 1 96 mod 19 = 1 =

and hence x 1 729 mod 7 = 0 = X mod 7 and x 1 72 9 mod 13 = X mod 13 and x 1 729 mod 19 = x mod 19 so that x 1 729 mod 1729 = x mod 1729 by the Chinese remainder theorem. The remaining cases can be handled in a similar manner. Observe that 1729 = 103 + 93 = 123 + 13. 15. Let x be an integer and p a prime dividing n. If p divides x, then xn mod p = 0 = x mod p If p does not divide x, then xn - 1

=

p (xp - 1 ) (n- 1 ) / ( - 1 )

=

1 (n - 1 ) / (p- 1 )

=

1 (modp)

so xn mod p = x mod p. Thus this equation holds for any prime p dividing n. By the Chinese remainder theorem, xn mod n = x mod n

PROBLEMS 7.4

355

17. Set m = 1 and do a loop such a8 for

k from

1 to 100 do;

if isprime{6 * k+1) = true and isprime{12 * k+1) = true and isprime{18 *k+ 1) = true then c [ m] :={6 * k+1) * {12 *k+ 1) * { 18 *k+ 1) ; m:=m+1 ; end if; end for

and observe that

c (1) c (2) c (3) c (4) c (5) c (6) c (7) c (8) c (9)

1729 = 294409 = 56052361 = 1 18901521 = 172947529 216821881 228842209 1299963601 2301745249 =

=

=

Problems 7.4

1. Since l v'899J

=

29, we check

8�9 8�9 899 17 8 99 29

449 � = 128¥ = 52 15 17 31 =

8�9 = 299 � 8 99 81 _§_ 11 11 899 - 47...2.. 19 19 =

8 99 = 179 � 5 5 899 69 2 13 13 99 = 39 2 823 23 =

-

and hence 899 = 29 31. ·

1. Factoring, we have 898 = 2 x 449. The 3. Note that gcd (2, 899) calculations 2449 mod 899 = 698 and 6982 mod 899 = 845 show that 899 is composite. =

5. Since 2P - 1 mod p 26 747, it follows from Fermat ' s little theorem that p is composite. Factorization shows that p = 449 x 457. =

356

SOLUTIONS TO ODD PROBLEMS

7. We have 187 736 503 - 1 = 2 x 93 868 251. Note that 293 868 25 1 mod 187 736 503 = 1 393 868 25 1 mod 187 736 503 = - 1 593 868 25 1 mod 187 736 503 = -1 793 868 25 1 mod 187 736 503 = 1 1 1 93 868 25 1 mod 187 736 503 = - 1 13 93 868 25 1 mod 187 736 503 = - 1 1 793 868 25 1 mod 187 736 503 = - 1 1 9 93 868 25 1 mod 187 736 503 = - 1 23 93 868 25 1 mod 187 736 503 = 1 29 93 868 2 5 1 mod 187 736 503 = - 1 and hence 187 736 503 passes Miller's test with n = 1 0 trials.

·� lnx-1 1 x ' Then J' (X ) = lnx-x 9 . Let f (X) = lnx (lnx /" = � � lnx and hence the average gap between primes j1 ( 10 100 ) = 4. 324 083 649 X 10 3 , is 4 . 324 083 �49 x 1 o � 231 . Assuming that on average you start halfway between two primes, and you only check even numbers, you will expect to test about 231 /4 � 58 numbers. 1 1 . The gaps are 1243 - 949 = 294 949 - 268 = 681 1293 - 1243 = 50 1983 - 1293 = 690 2773 - 1983 = 790 2809 - 2773 = 36 291 1 - 2809 = 102 2967 - 291 1 = 56 3501 - 3469 = 32 3469 - 2967 = 502 so the average gap is 681 + 294 + 50 + 690 + 790 + 36 + 102 + 56 + 502 + 32 = 323 � 10 10 which is somewhat larger than the expected gap given in problem 9. -

SO

3

Problems 7.5

1 . Note that gcd ( 7, 100 ) = 1. We have 73 7 mod 101 = 40 and 7 -1 mod 100 = 43 and 4043 mod 101 = 73, and hence 73 is recovered. 3. For example, let p = 3391 691 164 919 859 649 719 340 532 627 567 207 607 656 859 034 356 995 566 589 707 894 210 757 866 827 613 621 721 127 496 191 413

PROBLEMS 7.6

357

be the smallest prime

2::

5 1 50 mod 10 100

5. The numbers 2 04 7 679 804 982 929 369 090 035 623 502 251 062 360 672 859 815 645 1 503 714 396 228 131 674 104 263 081 904 252 158 592 322 776 941 888 958 411 586 724 601 781 693 914 292 292 892 305 522 540 318 192 363 442 582 571 176 226 543 020 134 304 037 361 597 914 795 908 agree at 10 spots (see the bold digits) . This is not a surprise because the process does a good job of mixing, and random 100-digit numbers would be expected to agree in about 10 spots (one-tenth of the time) . Problems 7.6 1 . Since 24 = 23 3, the integers {1 , 5, 7, 11, 13, 17, 19, 23} are relatively prime to 24 and cp(24) = 8. 3. We have cp(27) = cp(33 ) = 3 3 - 3 2 = 18. There are 18 integers

1 , 2, 4, 5, 7, 8, 10, 11, 13, 14, 16, 17, 19, 20, 22, 23, 25, 26 less than or equal to 27 that are relatively prime to 27. 5. Since 1001 = 7 x 11

x

13, we have cp(1001) = cp(7)cp(11)cp(13) = 6 · 10 · 12 = 720

Note that

5720 mod 1001

=

1

7. We start with the least nonnegative residue system R = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9} and construct {7r + 4 1 r E R} � { 4, 1 1 , 18, 25,· 32, 39, 46, 53, 60, 67} Note that

39 mod 10 = 9 4 mo d 1 0 = 4 46 mod 10 = 6 1 1 1 mod 10 53 mod 10 18 mod 10 8 3 60 mod 10 25 mod 10 = 5 0 67 mod 10 = 7 32 mod 10 = 2 and hence each element of {7r + 4 1 r E R} is congruent modulo 10 to exactly one element of R. =

358

SOL UTIONS TO ODD PROBLEMS

9. Let p be a prime that divides n. If p does not divide a , then aP - 1 = 1 (modp) so acp( n) = 1 (modp) because p - 1 divides r.p ( n) . Multiplying by a we get

acp( n) + 1 = a (modp) On the other hand, if p does divide a , then a = 0 = acp(n)H (modp) so, trivially, acp( n) + l = a (mod p) Thus acp(n ) + l = a (mod p) for each prime dividing n. But this says that each prime that divides n also divides acp( n) + l - a , so if n is a product of distinct primes, then n must divide acp(n) + l - a, that is, acp( n) +l a (mod n) . _

Chapter

8

Public Key Ciphers

Problems 8 . 1 1 . As m = 5 7 , we have r.p(35) = r.p(5)r.p(7) = 4 6 = 24. Then d = e - 1 mod r.p (m) = 1 1 -1 mod 24 = 1 1 , so ·

·

x e mod m = 22 1 1 mod 35 = 8 y z = yd mod m = 81 1 mod 35 = 22

See the disc for details of these computations. 3. As m = 29 31, we have r.p(m) = r.p(29)r.p(31) = 28 30 = 840 and d e - 1 mod r.p (m) = 101 - 1 mod 840 = 341 . So y = x e mod m = 555 101 mod 899 = 731 z = y d mod m = 731 341 mod 899 = 555 ·

·

=

5. Let x = 99999999999999, m = 25972641171898723, e = 997, and r.p = 25972640809676568 and note that y = xe mod m = 4815 828 410 330 867 d = e - 1 mod r.p = 1 1 514 450 589 645 981 yields yd mod m = 99 999 999 999 999. 7. The numbers p and q are found using p+q = m-r.p(m) + 1 = 15 481 643 766 690 322 656 570 354 930 733 675 907 594 344 877 898 320 382 154 352 656 607 014 and p - q = .j(p + q)2 - 4m = 12 326 200 145 806 231 064 298 751 424 387 459 058 535 358 406 473 593 017 996 013 777 132 860.

359

PROBLEMS 8.2

Then p = (p+ q)!(p-q) = 1577 721 810 442 045 796 135 801 753 173 108 424 529 493 235 712 363 682 079 169 439 737 077 and q = (p+ q); (p -q) =13 903 921 956 248 276 860 434 553 177 560 567 483 064 851 642 185 956 700 075 183 216 869 937. As a check, pq = 21 936 520 921 056 942 428 185 744 321 881 874 204 790 829 920 570 235 226 904 516 467 385 564 406 736 567 597 367 535 979 699 930 859 170 667 289 061 009 756 151 158 068 196 185 554 149 9. There are c.p (m) = (p - 1) (q - 1) numbers between 1 and m that are relatively prime to m. So there are m - (p - 1) ( q - 1) = p + q - 1 numbers x in that range with gcd (x, m) =f. 1 . Thus the probability of choosing a number x with gcd (x, m) =f. 1 is p+q - 1 � � � = + q p m m Problems 8.2 1. We have 12 3 mod 15 = 3 and 3 5 mod 21 = 12 and hence Kyle sends the message 12 to Sarah.

3. The product Pbqb is given by nb = 2748 401 157 849 763 = 433 834 446 478 963 so the public key is (eb, nb) = (9587, 433 834 446 478 963). Since c.p (nb) = (2748 401 - 1) (157 849 763 - 1) = 433 834 285 880 800, it follows that db = 9587 - 1 mod 433 834 285 880 800 = 394 14 7 97 4 342 523 and hence the private key is ·

(d8 , ns) = (394 147 974 342 523, 433 834 446 478 963)

5. Since n8 = 37 847 755 706 513 < nb = 433 834 446 478 963, Sean decrypts the message by first applying Brendon's public key, then Sean's private key to get

7 ( 386 686 175 803 129958 7 mod nb ) 28 526 1 26 032 45 mod ns 5112 397 193 243 2852 6 1 26 032 457 mod n8 = 1234 567 890 =

7. Since ni < nb , the plaintext message is encrypted by first using Janet's public key, then using Brendan's private key to get ( 99 999 999 785 3 mod 15 092 177) 1 64 1 65 mod 29 143 171 = 6136 937 1 64165 mod 29 143 171 = 24 506 902 9. Encryption yields

( 2000 0007907 mod 49 839 739) 22 91 3 1 6 5 mod 26 513 567 45 57 4 6 2 6 22 9 1 3 1 6 5 mod 26 513 567 = 6765 427 =

360

SOL UTIONS TO ODD PROBLEMS

and decryption yields ( 6765 4274637 mod 26 513 567) 45 679 243 mod 49 839 739 = 19 061 059 45 679 243 mod 49 839 739 = 44 781 288

Information can be lost when modular arithmetic with a large modulus is followed by modular arithmetic with a smaller modulus. 1 1. Since ni > nb , the plaintext message is encrypted by first using Brendon's private key, then using Janet's public key to get

( 99 999 ggg260733 1 57 830 32 1 636 6 1 9 mod 986 577 727 411 807 628 569) 1 77 264 463 mod 7029 75 7 456 346 007 993 017 = 889 504 247 126 301 481 385 1 77264 463 mod 7029 757 456 346 007 993 017 = 6165 005 940 876 305 088 312

13. Encryption yields 70 849 375 393 993 065 812 and decryption yields 333 146 600 281 273 156 600 517. Information can be lost when modular arithmetic with a large modulus is followed by modular arithmetic with a smaller modulus. By first applying Sarah's private key followed by Preston 's pub­ lic key, the encrypted message is 30 564 624 919 862 526 996 750 and de­ cryption yields 101 010 101 010 101 010 101. See the disc for details of these computations. Problems 8.3

1 . The ASCII values are given by

and hence the equivalent positive integer is 50 + 94 . 256 + 52 . 256 2 + 61 · 256 3 + 49 . 2564 + 54 . 2565 = 59 585 108 139 570 3. Sarah first translates the plaintext to large integers using the table 0 R 82 1 1 1 i s 105 115 s 0 115 111

n 1 1 0 32 a 32 97 r 1 14 32

R i 82 105 p 32 112 a t 97 116

v 1 18 r 114 32

s e 101 115 f 0 111 102 M I 77 73

t 1 16 32 s e 102 115 T 84 46

PROBLEMS 8.4

361

and the calculations x = 82 + 1 1 1c + 110c2 + 32c3 + 82c4 + 105c5 + 118c6 + 101c7 + 115c8 + 1 16c9 + 32c10 + 105 c 11 + 115c1 f + 32c1 3 + 97c1 4 + 32c1 5 + 1 1 2c 16 + 1 14c 1 7 + 1 1 1c 18 + 102c 1 9 = 584 802 410 296 329 453 294 993 117 073 566 607 047 018 835 794 y = 102 + 115c + 115c2 + 1 1 1c3 + 1 14c4 + 32c5 + 97c6 + 116c7 + 32c8 + 77c9 + 73c 10 + 84c 11 + 46c 12 = 3670 580 832 286 885 393 984 052 753 254 Since nk < n8 , Sarah first uses Kyle ' s public key, then her private key to encrypt the message as (xe k mod nk ) d• mod n8 = 6642 642 701 546 739 554 009 203 231 203 625 130 908 152 661 584 571 (yek mod nk ) d• mod n8 = 5781 828 020 001 339 664 1 10 566 141 724 658 323 575 128 107 486 053

5. The message is Multiplication is easy, but factorization is hard.

See the disc for details. 7. Since nk < n8 , Kyle first uses Sarah's public key then his own private key to calculate the numbers (x997 mod ns ) dk mod nk , (y 997 mod ns ) dk mod nk , and ( z 997 mod n8 ) dk mod nk . The message is RSA keys are typically 1 024 to 2048 bits long

See the disc for details. Problems 8.4

1. Note that 2=2